skilldrop-cli 0.16.42 → 0.16.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "0.16.42",
+  "version": "0.16.44",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/ai-engineering/skills/agent-config-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-config-review",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Review a coding agent's configuration for access broader than the work needs and give a verdict — SAFE AS CONFIGURED, TIGHTEN BEFORE USE or DO NOT USE — reading what actually wins across every scope (Claude Code user, project, local and managed settings; permission allow/deny/ask lists, defaultMode, sandbox, hooks, plugins, env; .mcp.json; subagent tool lists; Codex sandbox_mode and approval_policy and the profile in use; Cursor and Copilot agent settings), with each finding's file and line, what it lets happen in plain words, and the exact replacement config. Use when the user asks \"is this Claude Code / Codex / Cursor setup safe\", \"review our .claude/settings.json\", \"audit our agent permissions\", \"is Bash(npm:*) OK in the allow list\", \"check this repo's agent config before we open it\", or wants an agent's permissions tightened before use.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/ai-engineering/skills/agent-config-review/scripts/agent_config_scan.py

@@ -528,7 +528,12 @@ def check_server(entry, s, lines, relpath, rep):
             rep.flag("unpinned-package", where, "{} {}".format(cmd, " ".join(args)),
                      "runs whatever `{}` the registry serves at start-up{}".format(pkg or "?", ", installed without asking (-y)" if "-y" in args or "--yes" in args else ""))
     if launcher in ("docker", "podman"):
-        image = next((a for a in args if "/" in a or ":" in a and not a.startswith("-")), "")
+        value_flags = ("-v", "--volume", "--mount", "-e", "--env", "--env-file", "-p", "--publish", "-w", "--workdir",
+                       "--name", "--network", "-u", "--user", "--entrypoint", "-l", "--label", "--platform", "-h",
+                       "--hostname", "--add-host")
+        skip = {i + 1 for i, a in enumerate(args) if a in value_flags}
+        image = next((a for i, a in enumerate(args)
+                      if i not in skip and not a.startswith("-") and ("/" in a or ":" in a)), "")
         if image and "@sha256:" not in image and (":" not in image.split("/")[-1] or image.endswith(":latest")):
             rep.flag("unpinned-image", where, image, "runs whatever image the tag points at today")
         if any(a in ("--privileged", "--network=host") or a.startswith("/:/") or a.startswith("-v/") for a in args):

package/packs/ai-engineering/skills/ai-usage-report/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-usage-report",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Generate a per-user or team-level report on how AI tools are being used — volume, breadth, and effectiveness signals (e.g. whether AI outputs landed in shipped artifacts vs were generated and discarded). Consumes usage-event logs exported from an MCP server or other telemetry source. Use when a manager or team lead needs to understand AI adoption beyond raw counts — including spotting \"AI theater\" where people invoke AI to claim usage but don't act on the outputs.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },

package/packs/ai-engineering/skills/ai-usage-report/scripts/build_report.py

@@ -15,6 +15,7 @@ from __future__ import annotations
 import argparse
 import csv
 import json
+import math
 import sys
 from collections import Counter, defaultdict
 from datetime import datetime, timedelta, timezone
@@ -27,17 +28,26 @@ MIN_USERS_FOR_ROLLUP = 5
 
 def load_events(path: Path) -> list[dict]:
     suffix = path.suffix.lower()
-    if suffix == ".csv":
-        with path.open(newline="") as f:
-            return list(csv.DictReader(f))
-    if suffix in (".jsonl", ".ndjson"):
-        events = []
-        with path.open() as f:
-            for line in f:
-                s = line.strip()
-                if s:
-                    events.append(json.loads(s))
-        return events
+    try:
+        if suffix == ".csv":
+            with path.open(newline="", encoding="utf-8-sig") as f:
+                return list(csv.DictReader(f))
+        if suffix in (".jsonl", ".ndjson"):
+            events = []
+            with path.open(encoding="utf-8-sig") as f:
+                for n, line in enumerate(f, 1):
+                    s = line.strip()
+                    if s:
+                        try:
+                            event = json.loads(s)
+                        except ValueError as exc:
+                            raise SystemExit(f"error: {path.name} line {n} is not valid JSON ({exc.msg}); fix or remove that line")
+                        if not isinstance(event, dict):
+                            raise SystemExit(f"error: {path.name} line {n} is not a JSON object; each line must be one event object")
+                        events.append(event)
+            return events
+    except UnicodeDecodeError:
+        raise SystemExit(f"error: {path.name} is not UTF-8 text; save it as UTF-8 and re-run")
     raise SystemExit(f"error: unsupported file type {suffix!r} (use .csv or .jsonl)")
 
 
@@ -259,7 +269,7 @@ def render_per_user(per_user, tool_counter, signals, ctx, sort_for_effectiveness
         team_name=ctx["team_name"],
         start_date=ctx["start"].date().isoformat(),
         end_date=ctx["end"].date().isoformat(),
-        n_days=(ctx["end"] - ctx["start"]).days,
+        n_days=ctx["n_days"],
         n_users=len(per_user),
         n_invocations=total_invocations,
         n_distinct_tools=len(tool_counter),
@@ -281,7 +291,7 @@ def render_team_rollup(per_user, tool_counter, signals, ctx):
         )
 
     template = load_template("report-team-rollup.md", ctx["script_dir"])
-    n_days = max(1, (ctx["end"] - ctx["start"]).days)
+    n_days = max(1, ctx["n_days"])
 
     invocations_per_user_per_day = [
         d["invocations"] / n_days for d in per_user.values()
@@ -396,6 +406,11 @@ def main(argv) -> int:
     if not events:
         sys.stderr.write("error: input file has no events\n")
         return 1
+    missing = [k for k in ("timestamp", "user", "tool") if not any(k in e for e in events)]
+    if missing:
+        sys.stderr.write(f"error: input is missing required field(s): {', '.join(missing)} "
+                         f"(see templates/usage-event-schema.md)\n")
+        return 1
 
     signals = detect_signals(events)
     start, end = resolve_period(args.period, args.from_arg, args.to_arg)
@@ -411,6 +426,8 @@ def main(argv) -> int:
         "team_name": args.team_name,
         "start": start,
         "end": end,
+        # a partial day counts, so a date-only --to (pushed to 23:59:59) covers its whole day
+        "n_days": math.ceil((end - start).total_seconds() / 86400),
         "caveats_line": build_data_caveats_line(signals),
         "missing_section": build_missing_signals_section(signals),
         "generated_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),

package/packs/career/skills/cover-letter/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cover-letter",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Write a cover letter for one job from the person's resume and the posting: under a page, opening on the strongest evidence for the role, two or three specifics matched to what the employer asked for, and no enthusiasm, company facts or experience the person didn't supply. A script lists every figure and name in the letter that their own material doesn't contain. Works for any occupation and level. Use when the user says \"write a cover letter for this job\", \"draft a covering letter\", \"write the cover note for my application\", or needs an application email to go with a resume.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/career/skills/cover-letter/scripts/claim_check.py

@@ -52,6 +52,12 @@ saturday sunday full part time application applying while although though becaus
 during after before however also please thank thanks between over across within having most each every one two three
 """.split())
 DATE_LINE = re.compile(r"^\s*(?:\d{1,2}(?:st|nd|rd|th)?\s+)?[A-Z][a-z]{2,8}\.?\s+(?:\d{1,2}(?:st|nd|rd|th)?,?\s+)?\d{4}\s*$")
+# Past tenses that don't end in -ed, so a sentence-opening "Wrote" reads as a verb like "Managed".
+IRREGULAR_PAST = set("""
+wrote rewrote built rebuilt ran drove grew won took undertook gave brought taught held upheld kept
+sold spoke began chose met oversaw cut put found understood spent sent dealt bought thought sought
+split withdrew became went got knew overcame made told paid stood broke
+""".split())
 # The joining words allowed inside a capitalised phrase: "Head of Geography".
 JOINERS = {"of", "and", "for", "the", "in", "at", "&", "de"}
 STOP = PLAIN | set("""
@@ -165,7 +171,7 @@ def phrases(line):
             continue
         # A sentence-opening verb in front of a name ("Led AWS migration") is dropped from the run.
         if len(r) > 1 and r[0][1] and not looks_named(r[0][0]) and r[0][0].lower() not in PLAIN:
-            r = r[1:] if r[0][0].lower().endswith(("ed", "ing")) else r
+            r = r[1:] if r[0][0].lower().endswith(("ed", "ing")) or r[0][0].lower() in IRREGULAR_PAST else r
         words = [w for w, _ in r]
         while words and words[-1].lower() in JOINERS:
             words.pop()
@@ -174,6 +180,20 @@ def phrases(line):
     return cleaned
 
 
+def separate_names(words, src_flat):
+    """True when a joiner only links names the source has whole: "SQL for Northwind Traders"."""
+    parts, part = [], []
+    for w in words + ["&"]:
+        if w.lower() in JOINERS:
+            if part:
+                parts.append(part)
+            part = []
+        else:
+            part.append(w)
+    return len(parts) > 1 and all((len(p) > 1 or looks_named(p[0]))
+                                  and " " + " ".join(key(w) for w in p) + " " in src_flat for p in parts)
+
+
 def check(draft, sources, posting):
     src_names, src_stems, src_flat = vocabulary("\n".join(sources))
     src_numbers = numbers("\n".join(clean(s) for s in sources))
@@ -202,9 +222,11 @@ def check(draft, sources, posting):
             missing = [w for w in content if key(w) not in src_names and w.lower() not in PLAIN]
             if missing:
                 add("name", " ".join(words), n, raw, all(key(w) in post_names for w in missing))
-            elif len(content) > 1 and all(w.lower() not in PLAIN for w in content):
+            elif (len(content) > 1 and any(w.lower() not in PLAIN for w in content)
+                  and all(w.lower() not in PLAIN or key(w) in src_names for w in content)):
+                # every word is sourced (a plain word like "Manager" only if the source has it)
                 flat = " ".join(key(w) for w in words if w != "&")
-                if " " + flat + " " not in src_flat:
+                if " " + flat + " " not in src_flat and not separate_names(words, src_flat):
                     add("combination", " ".join(words), n, raw)
         if posting:
             for w in WORD.findall(body):

package/packs/career/skills/resume-tailor/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "resume-tailor",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Tailor a resume or CV to one job posting without adding anything that isn't true: reorder, cut and reword what the person has already done so the posting's needs are answered first, keep every employer, title, date and number as it was, and report what the posting asks for that the resume cannot claim. A script lists every figure and name in the draft that the original doesn't contain. Works for any occupation and level. Use when the user says \"tailor my resume for this job\", \"adapt my CV to this posting\", \"rewrite my resume for this role\", or pastes a job description next to their resume.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/career/skills/resume-tailor/scripts/claim_check.py

@@ -52,6 +52,12 @@ saturday sunday full part time application applying while although though becaus
 during after before however also please thank thanks between over across within having most each every one two three
 """.split())
 DATE_LINE = re.compile(r"^\s*(?:\d{1,2}(?:st|nd|rd|th)?\s+)?[A-Z][a-z]{2,8}\.?\s+(?:\d{1,2}(?:st|nd|rd|th)?,?\s+)?\d{4}\s*$")
+# Past tenses that don't end in -ed, so a sentence-opening "Wrote" reads as a verb like "Managed".
+IRREGULAR_PAST = set("""
+wrote rewrote built rebuilt ran drove grew won took undertook gave brought taught held upheld kept
+sold spoke began chose met oversaw cut put found understood spent sent dealt bought thought sought
+split withdrew became went got knew overcame made told paid stood broke
+""".split())
 # The joining words allowed inside a capitalised phrase: "Head of Geography".
 JOINERS = {"of", "and", "for", "the", "in", "at", "&", "de"}
 STOP = PLAIN | set("""
@@ -165,7 +171,7 @@ def phrases(line):
             continue
         # A sentence-opening verb in front of a name ("Led AWS migration") is dropped from the run.
         if len(r) > 1 and r[0][1] and not looks_named(r[0][0]) and r[0][0].lower() not in PLAIN:
-            r = r[1:] if r[0][0].lower().endswith(("ed", "ing")) else r
+            r = r[1:] if r[0][0].lower().endswith(("ed", "ing")) or r[0][0].lower() in IRREGULAR_PAST else r
         words = [w for w, _ in r]
         while words and words[-1].lower() in JOINERS:
             words.pop()
@@ -174,6 +180,20 @@ def phrases(line):
     return cleaned
 
 
+def separate_names(words, src_flat):
+    """True when a joiner only links names the source has whole: "SQL for Northwind Traders"."""
+    parts, part = [], []
+    for w in words + ["&"]:
+        if w.lower() in JOINERS:
+            if part:
+                parts.append(part)
+            part = []
+        else:
+            part.append(w)
+    return len(parts) > 1 and all((len(p) > 1 or looks_named(p[0]))
+                                  and " " + " ".join(key(w) for w in p) + " " in src_flat for p in parts)
+
+
 def check(draft, sources, posting):
     src_names, src_stems, src_flat = vocabulary("\n".join(sources))
     src_numbers = numbers("\n".join(clean(s) for s in sources))
@@ -202,9 +222,11 @@ def check(draft, sources, posting):
             missing = [w for w in content if key(w) not in src_names and w.lower() not in PLAIN]
             if missing:
                 add("name", " ".join(words), n, raw, all(key(w) in post_names for w in missing))
-            elif len(content) > 1 and all(w.lower() not in PLAIN for w in content):
+            elif (len(content) > 1 and any(w.lower() not in PLAIN for w in content)
+                  and all(w.lower() not in PLAIN or key(w) in src_names for w in content)):
+                # every word is sourced (a plain word like "Manager" only if the source has it)
                 flat = " ".join(key(w) for w in words if w != "&")
-                if " " + flat + " " not in src_flat:
+                if " " + flat + " " not in src_flat and not separate_names(words, src_flat):
                     add("combination", " ".join(words), n, raw)
         if posting:
             for w in WORD.findall(body):

package/packs/converters/skills/file-to-markdown/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "file-to-markdown",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Convert a Word document, PowerPoint deck, Excel workbook, web page, CSV, JSON, text file, email (.eml or Outlook .msg) or PDF into clean Markdown that keeps headings, lists, tables, links, bold and italic, slide titles and speaker notes, and reports everything it dropped (images, charts, comments, formulas, tracked changes), so the content can be read, reviewed or fed to another skill. Use when the user hands over a .docx, .pptx, .xlsx, .html, .csv, .json, .eml, .msg or .pdf and says \"read this\", \"turn this into markdown\", \"extract the text\", or wants it critiqued or briefed.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/file-to-markdown/scripts/to_markdown.py

@@ -1554,9 +1554,11 @@ def _join_split_tables(pages, rep):
                                   (not a[start - 1].strip() and start - 2 >= 0 and len(_cells(a[start - 2])) == width)):
             start -= 1
         header = " ".join(a[start].split())
-        # the first content on the next page, past page numbers and a running header
+        # the first content on the next page, past page numbers and a running header (a line
+        # that repeats the table's own header is the table's, not the page's)
         i = 0
-        while i < len(b) and (not b[i].strip() or _FURNITURE.match(b[i]) or b[i].strip() in running):
+        while i < len(b) and (not b[i].strip() or _FURNITURE.match(b[i]) or
+                              (b[i].strip() in running and " ".join(b[i].split()) != header)):
             i += 1
         if i >= len(b) or len(_cells(b[i])) != width:
             continue

package/packs/converters/skills/md-to-confluence/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "md-to-confluence",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn a Markdown runbook, design note or guide into a Confluence page: storage-format XHTML with real code blocks, tables, tasks, info and warning panels, images as attachments and an optional contents macro, a warning for everything dropped, and an optional publish that first shows which page it will create or overwrite and at what version, refuses stale or wrong-space overwrites, and takes credentials only from the environment. Use when the user says \"put this in Confluence\", \"publish this markdown to the wiki\", \"update the Confluence page with this\", \"convert to Confluence storage format\", or names a Confluence space for a Markdown file.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/md-to-confluence/scripts/md_to_confluence.py

@@ -209,7 +209,9 @@ def inline(text, ctx):
     # Decode character references (& — —) outside the stashed pieces, then escape
     # everything once. Only semicolon-terminated ones, so "?a=1&para=2" stays as typed.
     parts = re.split("(%s\\d+%s)" % (STASH_OPEN, STASH_CLOSE), text)
-    text = "".join(pt if k % 2 else ENTITY_RE.sub(lambda m: html.unescape(m.group(0)), pt).translate(XML_BAD)
+    # The decoded characters are cleaned of what XML can't hold; the source was cleaned already, and
+    # cleaning it again would delete the \x01 hard-break placeholder.
+    text = "".join(pt if k % 2 else ENTITY_RE.sub(lambda m: html.unescape(m.group(0)).translate(XML_BAD), pt)
                    for k, pt in enumerate(parts))
     text = emphasis(esc(text))
     pat = re.compile("%s(\\d+)%s" % (STASH_OPEN, STASH_CLOSE))
@@ -277,7 +279,7 @@ def code_macro(code, lang, ctx):
             "<ac:plain-text-body>%s</ac:plain-text-body></ac:structured-macro>" % (params, cdata(code)))
 
 
-def render_table(rows, aligns, ctx):
+def render_table(rows, aligns, ctx, row_lines):
     ctx.counts["tables"] += 1
     width = len(aligns)
 
@@ -290,6 +292,7 @@ def render_table(rows, aligns, ctx):
 
     out = ["<table><tbody>"]
     for r_i, r in enumerate(rows):
+        ctx.line = row_lines[r_i]  # warnings name the row's own line
         if len(r) != width:
             ctx.warn("table row %d has %d cells, the header has %d; padded or cut" % (r_i, len(r), width))
         r = (r + [""] * width)[:width]
@@ -356,13 +359,13 @@ def render_blocks(lines, ctx, tight=False):
                 c = c.strip()
                 aligns.append("center" if c.startswith(":") and c.endswith(":") else
                               "right" if c.endswith(":") else "left" if c.startswith(":") else None)
-            rows = [split_row(line)]
+            rows, row_lines = [split_row(line)], [ctx.line]
             i += 2
             while i < n and lines[i].strip() and "|" in lines[i]:
-                ctx.line = getattr(lines[i], "ln", 0)
                 rows.append(split_row(lines[i]))
+                row_lines.append(getattr(lines[i], "ln", 0))
                 i += 1
-            out.append(render_table(rows, aligns, ctx))
+            out.append(render_table(rows, aligns, ctx, row_lines))
             continue
 
         if QUOTE_RE.match(line):

package/packs/converters/skills/md-to-html/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "md-to-html",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Turn a Markdown draft into one self-contained, print-friendly HTML file that survives being emailed or attached, with headings that have anchor links, tables, code, quotes, an optional table of contents, local images embedded, brand colours and fonts from a brand.json, Mermaid diagrams kept as text or drawn from a pinned CDN, and raw HTML escaped so nothing in the source runs. Use when the user wants Markdown \"as a web page\", \"as an HTML file I can send\", \"something people can open in a browser and print\", or says \"convert this to HTML\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/md-to-html/scripts/md_to_html.py

@@ -439,6 +439,9 @@ def load_brand(path, ctx):
         data = json.loads(p.read_text(encoding="utf-8"))
     except ValueError as e:
         sys.exit("error: brand file is not valid JSON: %s (%s)" % (path, e))
+    if not isinstance(data, dict):
+        sys.exit("error: brand file must hold a JSON object (brand-kit shape), not a %s: %s"
+                 % (type(data).__name__, path))
     colors = data.get("colors") or {}
     for key in ("primary", "secondary", "accent", "background", "text"):
         v = colors.get(key)
@@ -525,7 +528,11 @@ def build_toc(headings):
     out = ['<nav class="toc" aria-label="Contents"><p>Contents</p><ul>']
     depth = 2
     first = True
+    seen_h2 = False
     for lvl, hid, txt in items:
+        seen_h2 = seen_h2 or lvl == 2
+        if not seen_h2:
+            lvl = 2  # a ### before any ## has no parent to nest under: list it at the top level
         link = '<a href="#%s">%s</a>' % (hid, re.sub(r"<a [^>]*>|</a>", "", txt))
         if lvl > depth:
             out.append("<ul>")

package/packs/converters/skills/md-to-pptx/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "md-to-pptx",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn an existing Markdown document (a status report, runbook, review or notes) into a PowerPoint deck (.pptx) that opens without a repair prompt, with nothing to install. Each heading becomes a slide, lists keep their nesting, tables become real PowerPoint tables, images are embedded, and comments become speaker notes. A section too long for one slide is split onto \"continued\" slides instead of shrinking the text, and the reply names every split, everything dropped, and any speaker note that would go out with the file. Use when the user says \"turn this markdown into slides\", \"make this report a PowerPoint\", \"convert the .md to pptx\", \"I need this as a deck for Thursday\", or \"export these notes to PowerPoint\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/md-to-pptx/scripts/md_to_pptx.py

@@ -714,12 +714,13 @@ def wrapped_lines(text, cpl):
         lines, cur = 1, 0
         for w in words:
             wl = len(w)
-            while wl > cpl:  # a very long token (URL) breaks mid-word
+            if wl > cpl:  # a very long token (URL) starts a fresh line and breaks mid-word
                 if cur:
                     lines += 1
-                lines += wl // cpl - (1 if cur == 0 else 0)
-                wl = wl % cpl
-                cur = 0
+                full, rest = divmod(wl, cpl)
+                lines += full - 1 + (1 if rest else 0)
+                cur = rest if rest else cpl
+                continue
             need = wl + (1 if cur else 0)
             if cur + need > cpl:
                 lines += 1

package/packs/converters/skills/mermaid-render/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "mermaid-render",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Check Mermaid diagrams for the mistakes that stop them rendering (unknown diagram type, unbalanced brackets or quotes, unquoted parentheses in labels, the word end as a node id, missing arrows, unclosed subgraphs or alt blocks) with line numbers and a fix for each, then render them to SVG, PNG or PDF with mermaid-cli, or to a standalone HTML page when it is not installed. Works on a .mmd file or every mermaid fence in a Markdown doc. Use when a diagram \"won't render\", the user says \"check my mermaid\", \"export this diagram as SVG/PNG\", or needs the diagrams in a doc as image files.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/converters/skills/mermaid-render/scripts/render_mermaid.py

@@ -188,7 +188,8 @@ def lint_flowchart(lines, issues):
             elif re.match(r'^"[^"]*"$', rest):
                 pass
             elif re.match(r"^[^\W][\w.-]*\s*[\[({>]", rest, re.U):
-                scan_nodes(rest, ln, issues)              # subgraph id[label]
+                # subgraph id[label], or id [label] as the Mermaid docs write it
+                scan_nodes(re.sub(r"^([^\W][\w.-]*)\s+", r"\1", rest, flags=re.U), ln, issues)
             elif re.search(r"[\[\](){}]", rest):
                 issues.append(Issue(ln, "error", "subgraph title has unquoted brackets; write "
                                     "subgraph id[\"%s\"]" % rest.replace('"', "'")))

package/packs/core/skills/output-hygiene/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "output-hygiene",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Review agent-written text before it ships and strip the machine artifacts it carries — invisible Unicode, non-breaking spaces, homoglyphs, harness-added provenance trailers, trailing chat closers — then flag the prose tells a script cannot catch, each quoted with a rewrite. Use when the user wants to clean up AI-generated output, asks to remove a Claude watermark, attribution footer, or \"Generated with\" line, wants a draft that does not read as machine-written, or needs a pre-ship hygiene pass on a document, commit message, or pasted chat answer.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/core/skills/output-hygiene/scripts/scrub.py

@@ -210,8 +210,9 @@ def scan(text, ascii_mode=False, medium="markdown"):
     blocks = re.split(r"\n\s*\n", trimmed)
     if len(blocks) > 1 and CLOSER_OPENERS.match(blocks[-1].strip()):
         tail = blocks[-1]
-        idx = trimmed.rfind(tail)
-        findings.append(_finding("closer", "auto", trimmed.count("\n", 0, max(idx, 0)) + 1, 1,
+        # Findings describe the ORIGINAL text, so locate the closer there, not in `cleaned`.
+        idx = text.rfind(tail.lstrip("\n").split("\n")[0])
+        findings.append(_finding("closer", "auto", text.count("\n", 0, max(idx, 0)) + 1, 1,
                                  "trailing chat closer — addresses a chat partner, not a reader",
                                  " ".join(tail.split())[:80]))
         cleaned = "\n\n".join(blocks[:-1]).rstrip() + ("\n" if text.endswith("\n") else "")

package/packs/data-analytics/skills/sql-review/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "sql-review",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Review a SQL query for correctness first and performance second — join fan-out inflating sums, NULL traps in filters and NOT IN, timezone and date-boundary errors, integer division, DISTINCT hiding a bad join, window-frame defaults, implicit casts, non-sargable predicates and missing partition filters — with each finding tied to a line, the wrong number it produces, and corrected SQL for the named dialect. Use when the user pastes a query and asks \"is this right\", \"review my SQL\", \"why is this number too high\", \"check this before it goes in the dashboard\", or \"make this query faster\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/data-analytics/skills/sql-review/scripts/sql_lint.py

@@ -225,7 +225,11 @@ class Linter:
             if mt.group(1) == "sum" and div.group(2) == "sum":
                 continue
             before = self.low[max(0, mt.start() - 15):mt.start()]
-            if re.search(r"(1\.0\s*\*|cast\s*\(\s*|::\s*\w*\s*)$", before) or rest.startswith("::"):
+            if re.search(r"(1\.0\s*\*\s*|cast\s*\(\s*|::\s*\w*\s*)$", before) or rest.startswith("::"):
+                continue
+            # A cast on the denominator (count(*)::float, nullif(...)::numeric) also makes it float.
+            dopen = end + (div.start(1) + div.group(1).index("(") if div.group(1) else div.end() - 1)
+            if self.low[skip_parens(self.low, dopen):].lstrip().startswith("::"):
                 continue
             sev = "warn" if (mt.group(1) == "count" and div.group(2) == "count") else "info"
             label = "COUNT / COUNT" if sev == "warn" else "SUM / COUNT"
@@ -320,12 +324,15 @@ class Linter:
         return spans
 
     def left_join_where(self) -> None:
-        pat = re.compile(r"\bleft\s+(?:outer\s+)?join\s+[\w`\".]+\s+(?:as\s+)?(\w+)")
+        pat = re.compile(r"\bleft\s+(?:outer\s+)?join\s+([\w`\".]+)\s+(?:as\s+)?(\w+)")
         aliases = set()
         for mt in pat.finditer(self.low):
-            a = mt.group(1)
+            a = mt.group(2)
             if a not in ("on", "using", "where"):
                 aliases.add(a)
+            else:
+                # No alias: WHERE refers to the table by its own (unqualified) name.
+                aliases.add(mt.group(1).split(".")[-1].strip("`\""))
         if not aliases:
             return
         for start, end in self.where_clauses():

package/packs/design/skills/brand-kit/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "brand-kit",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Capture a brand once as a reusable brand.json — logo files (and an on-dark version), colour roles as hex codes, heading and body fonts, voice, imagery rules, a PowerPoint template, contact details and the legal footer — plus a one-page BRAND.md, with text contrast checked and every value traced to where it came from. Use when the user wants decks, flyers or documents in their branding, says \"use our brand\", \"here's our logo and colours\", \"set up our brand kit\", or hands over brand guidelines.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/design/skills/brand-kit/scripts/check_brand.py

@@ -42,10 +42,16 @@ def main(argv):
     path = Path(argv[0]).expanduser().resolve()
     base = path.parent
     try:
-        brand = json.loads(path.read_text(encoding="utf-8"))
+        brand = json.loads(path.read_text(encoding="utf-8-sig"))
     except (OSError, json.JSONDecodeError) as e:
         print(f"FAIL cannot read {path}: {e}")
         return 1
+    except UnicodeDecodeError:
+        print(f"FAIL cannot read {path}: it is not UTF-8 text; save it as UTF-8")
+        return 1
+    if not isinstance(brand, dict):
+        print(f"FAIL cannot read {path}: expected a JSON object like {{\"colors\": ...}}, got a {type(brand).__name__}")
+        return 1
     fails, warns = [], []
 
     colors = brand.get("colors") or {}
@@ -53,23 +59,23 @@ def main(argv):
         v = colors.get(role)
         if not v:
             warns.append(f"colors.{role} is missing; the generators will derive it from the others")
-        elif not HEX.match(v):
+        elif not HEX.match(str(v)):
             fails.append(f"colors.{role} is {v!r}, not a 6-digit hex code like #1A2A6C")
     for x in colors.get("extra") or []:
         if not HEX.match(str(x.get("hex", ""))):
             fails.append(f"colors.extra {x.get('name', '?')!r} has hex {x.get('hex')!r}")
-    if HEX.match(colors.get("text", "")) and HEX.match(colors.get("background", "")):
+    if HEX.match(str(colors.get("text", ""))) and HEX.match(str(colors.get("background", ""))):
         r = contrast(colors["text"], colors["background"])
         if r < 4.5:
             fails.append(f"text on background contrast is {r:.2f}:1, below 4.5:1")
         print(f"  text on background   {r:5.2f}:1")
-    if HEX.match(colors.get("primary", "")):
+    if HEX.match(str(colors.get("primary", ""))):
         r = contrast("#FFFFFF", colors["primary"])
         msg = f"white text on primary is {r:.2f}:1"
         if r < 4.5:
             warns.append(msg + " — slide title bars and flyer bands will use dark text instead")
         print(f"  white on primary     {r:5.2f}:1")
-    if HEX.match(colors.get("accent", "")) and HEX.match(colors.get("background", "")):
+    if HEX.match(str(colors.get("accent", ""))) and HEX.match(str(colors.get("background", ""))):
         r = contrast(colors["accent"], colors["background"])
         if r < 3:
             warns.append(f"accent on background is {r:.2f}:1 — use the accent for shapes and rules, not text")

package/packs/design/skills/deck-builder/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "deck-builder",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Generate a real PowerPoint (.pptx) file from content, audience, and either a brand template or a color palette — with charts, tables and images, not only bullets. Slide count, density and layout are tuned to the audience: execs, boards, technical reviewers, sales prospects, investors, internal teams. Use when the user wants an actual editable .pptx rather than an outline, wants their corporate template or brand colours applied, or says \"build the deck\", \"make it a pptx\", \"use our template\".",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/design/skills/deck-builder/scripts/build_deck.py

@@ -34,13 +34,17 @@ import zipfile
 from dataclasses import dataclass
 from pathlib import Path
 
-from pptx import Presentation
-from pptx.chart.data import CategoryChartData
-from pptx.dml.color import RGBColor
-from pptx.enum.chart import XL_CHART_TYPE, XL_LEGEND_POSITION
-from pptx.enum.shapes import MSO_SHAPE, PP_PLACEHOLDER
-from pptx.enum.text import MSO_ANCHOR, PP_ALIGN
-from pptx.util import Emu, Inches, Pt
+try:
+    from pptx import Presentation
+    from pptx.chart.data import CategoryChartData
+    from pptx.dml.color import RGBColor
+    from pptx.enum.chart import XL_CHART_TYPE, XL_LEGEND_POSITION
+    from pptx.enum.shapes import MSO_SHAPE, PP_PLACEHOLDER
+    from pptx.enum.text import MSO_ANCHOR, PP_ALIGN
+    from pptx.util import Emu, Inches, Pt
+except ImportError:
+    sys.stderr.write("error: python-pptx is not installed; install it with: pip install python-pptx\n")
+    sys.exit(1)
 
 # The design canvas every hardcoded position below is expressed in. Real slide
 # geometry comes from Canvas, which scales these to the actual deck size.
@@ -960,7 +964,8 @@ def load_brand(ref, base: Path):
         return {}, base
     if isinstance(ref, dict):
         return ref, base
-    path = (base / ref).expanduser() if not Path(ref).is_absolute() else Path(ref)
+    path = Path(ref).expanduser()
+    path = path if path.is_absolute() else base / path
     if not path.exists():
         warn(f"brand file not found: {path}; building without it")
         return {}, base
@@ -1024,7 +1029,12 @@ def place_logo(slide, c: "Canvas", palette: dict, logical: str) -> None:
 
 
 def build(spec_path: Path, out_path: Path, script_dir: Path, *, strict: bool, brand_ref=None) -> None:
-    spec = json.loads(spec_path.read_text(encoding="utf-8"))
+    try:
+        spec = json.loads(spec_path.read_text(encoding="utf-8-sig"))
+    except json.JSONDecodeError as e:
+        die(f"spec {spec_path} is not valid JSON ({e}); fix it and re-run")
+    except UnicodeDecodeError:
+        die(f"spec {spec_path} is not UTF-8 text; save it as UTF-8 and re-run")
     spec_dir = spec_path.parent
     brand, brand_dir = load_brand(brand_ref or spec.get("brand"), spec_dir)
     if brand:

package/packs/design/skills/marketing-flyer/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "marketing-flyer",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Generate a print-ready, on-brand marketing flyer — event, launch, open day, offer, hiring — as one self-contained HTML file (Letter, A4, A5, or square and story sizes for social) that saves to PDF, built from the user's own logo, colours, fonts and content, with one call to action, a short headline, contrast checked, and no invented dates, prices or contact details. Use when the user wants a flyer, poster, one-pager, handout, leaflet or event announcement \"in our branding\", or says \"make a flyer for…\".",
   "entrypoint": "SKILL.md",
   "deps": {