tachibot-mcp 2.26.0 → 2.26.1

package/README.md

@@ -4,7 +4,7 @@
 
 ### Multi-Model AI Orchestration Platform
 
-[![Version](https://img.shields.io/badge/version-2.26.0-blue.svg)](https://www.npmjs.com/package/tachibot-mcp)
+[![Version](https://img.shields.io/badge/version-2.26.1-blue.svg)](https://www.npmjs.com/package/tachibot-mcp)
 [![Tools](https://img.shields.io/badge/tools-64_active-brightgreen.svg)](#-tool-ecosystem-64-tools)
 [![License](https://img.shields.io/badge/license-AGPL--3.0-green.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%3E%3D22.0.0-brightgreen.svg)](https://nodejs.org)
@@ -28,25 +28,32 @@ from Claude Code, Claude Desktop, Cursor, or any MCP client.
 
 ---
 
-## What's New in v2.26.0
+## What's New
 
-### Prompt stack, modernized
+### v2.26.1
+- **`/test` and `/audit` skills** (19 skills total) — `/test` generates runnable tests via `testgen`; `/audit` runs an OWASP/CWE security review via `security_review`.
+- **Skill install in the wizard** — `tachibot init` now offers to install Claude Code skills with a per-skill skip choice (`[Enter]`=all · `[s]`=choose which to skip · `[n]`=none). Skills are opt-in — `postinstall` no longer writes to `~/.claude` silently (`npm run install-skills` still installs all non-interactively).
+- **Fixes** — the one-click `.mcpb` extension now points at a valid entry point (was broken) and tracks the package version; `tachibot init` exits cleanly on non-interactive/CI stdin instead of hanging.
+
+### v2.26.0
+
+#### Prompt stack, modernized
 - **`refine_prompt`** (new tool) — opt-in prompt improver on a cheap/fast model: raw query → goal-first brief + **what changed** + **open questions**. Never auto-fires, never executes anything — you review, then use the brief. In Claude Code, `/prompt refine` presents the open questions as clickable choices and merges your answers into a final brief.
 - **Curated technique list** — `list_prompt_techniques` now defaults to the ~9 core techniques that still help 2026 reasoning models (output contracts like `scot`, `pre_mortem`, `bdd_spec`); `all=true` for the full 31.
 - **`technique="auto"`** — `preview_prompt_technique` recommends the right technique for your task, with reasons. Ask `tachi` "improve my prompt" for the symptom-based menu.
 
-### Setup, de-mystified
+#### Setup, de-mystified
 - **`tachibot init`** (new CLI wizard) — detects your API keys and clients, prints the exact config for Claude Code and Claude Desktop. Never writes or echoes keys.
 - **One-click Claude Desktop install** — download the `.mcpb` from the latest release and double-click. No JSON editing.
 - **`doctor`** — shows which keys are set, which tools are visible vs hidden and why, and what to try first.
 
-### New tools & skills (64 tools · 17 skills)
+#### New tools & skills (64 tools · 19 skills)
 - `debug_triage` — ranked root-cause hypotheses with the cheapest discriminating check for each (Grok 4.3)
 - `spec_writer` — loose request → reviewable spec: user stories, Given/When/Then, out-of-scope, open questions (GPT-5.5)
 - `diff_review` / `plan_critique` / `testgen` / `security_review` — multi-model diff review, adversarial plan red-team, test generation, OWASP/CWE audit
 - Skills: `/review`, `/redteam`, `/spec`, `/triage`, `/setup`
 
-### Fixes
+#### Fixes
 - `focus` orchestration screen: 37 lines of repeated scaffolding → 10 focused lines
 - `npm test` exits 0 again (uncancelled race timers leaked past Jest teardown)
 - GPT-5.5 high-effort reasoning no longer cut off at 3 minutes (timeout 180s → 600s)
@@ -55,7 +62,7 @@ from Claude Code, Claude Desktop, Cursor, or any MCP client.
 
 ## Skills (Claude Code)
 
-TachiBot ships with 17 slash commands for Claude Code. These orchestrate the tools into powerful workflows:
+TachiBot ships with 19 slash commands for Claude Code. These orchestrate the tools into powerful workflows:
 
 | Skill | What it does | Example |
 |-------|-------------|---------|
@@ -75,6 +82,8 @@ TachiBot ships with 17 slash commands for Claude Code. These orchestrate the too
 | `/review` | Multi-model diff review — panel + Gemini judge verdict | `/review` (or paste a diff) |
 | `/redteam` | Adversarial plan red-team — pre-mortem, risks, plan edits | `/redteam <paste plan>` |
 | `/triage` | Ranked root-cause bug triage | `/triage <paste stack trace>` |
+| `/test` | Generate runnable tests (edge cases first) | `/test src/auth.ts` |
+| `/audit` | Security review — OWASP/CWE findings + fixes | `/audit the login handler` |
 | `/tachi` | Help - see available skills, tools, key status | `/tachi` |
 
 Skills automatically adapt to your configured API keys. Even with just 1-2 providers, all skills work.

package/dist/src/cli/init.js

@@ -8,6 +8,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as readline from "node:readline/promises";
+import { fileURLToPath } from "node:url";
 const KEYS = [
     { name: "OpenRouter", envVar: "OPENROUTER_API_KEY", unlocks: "DeepSeek/GLM/Kimi/Qwen/MiniMax/StepFun/ERNIE + planner (~30 tools)" },
     { name: "Perplexity", envVar: "PERPLEXITY_API_KEY", unlocks: "web research tools" },
@@ -86,6 +87,62 @@ export function buildDesktopSnippet(setup, profile) {
     return JSON.stringify({ mcpServers: { tachibot: { command: "tachibot", env } } }, null, 2);
 }
 const mask = (v) => (v ? `${v.slice(0, 6)}…` : "");
+/** The package's bundled skills dir. dist/src/cli/init.js → up 3 → pkg root. */
+export function resolveSkillsDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, "..", "..", "..", "skills");
+}
+/** Read `skills/<name>/SKILL.md`, pulling the frontmatter `description`. */
+export function listAvailableSkills(skillsDir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(skillsDir).sort();
+    }
+    catch {
+        return [];
+    }
+    const skills = [];
+    for (const name of entries) {
+        let text;
+        try {
+            text = fs.readFileSync(path.join(skillsDir, name, "SKILL.md"), "utf8");
+        }
+        catch {
+            continue;
+        } // not a skill dir
+        const m = text.match(/^description:\s*(.+)$/m);
+        skills.push({ name, description: m ? m[1].trim() : "" });
+    }
+    return skills;
+}
+/**
+ * Parse a "skip which" answer ("1,3, 5") into a set of 0-based indices over a
+ * list of `count`. Blanks, non-numbers, and out-of-range tokens are ignored so
+ * a fat-fingered entry never throws or skips the wrong skill.
+ */
+export function parseSkipSelection(input, count) {
+    const skip = new Set();
+    for (const tok of input.split(/[\s,]+/).filter(Boolean)) {
+        const n = Number(tok);
+        if (Number.isInteger(n) && n >= 1 && n <= count)
+            skip.add(n - 1);
+    }
+    return skip;
+}
+/** Copy the chosen skills' SKILL.md into `targetDir/<name>/`. Returns installed names. */
+export function installSkills(names, skillsDir, targetDir) {
+    const installed = [];
+    for (const name of names) {
+        const src = path.join(skillsDir, name, "SKILL.md");
+        if (!fs.existsSync(src))
+            continue;
+        const dest = path.join(targetDir, name);
+        fs.mkdirSync(dest, { recursive: true });
+        fs.copyFileSync(src, path.join(dest, "SKILL.md"));
+        installed.push(name);
+    }
+    return installed;
+}
 export async function runInitWizard() {
     const setup = detectSetup();
     const out = (s) => process.stdout.write(s + "\n");
@@ -100,12 +157,27 @@ export async function runInitWizard() {
     out("\nClients detected:");
     out(`  ${setup.clients.claudeCode ? "✓" : "✗"} Claude Code (claude on PATH)`);
     out(`  ${setup.clients.claudeDesktop ? "✓" : "✗"} Claude Desktop${setup.clients.desktopConfigPath ? ` (${setup.clients.desktopConfigPath})` : ""}`);
+    // Non-interactive (piped stdin / CI): prompting would hang on EOF with an
+    // "unsettled top-level await". Print the config for both clients with sane
+    // defaults and how to install skills, then exit cleanly.
+    if (!process.stdin.isTTY) {
+        out("\n(non-interactive: printing full config — run in a terminal to choose options)\n");
+        out("— Claude Code —\n");
+        out(buildClaudeCodeCommand(setup));
+        out("\n— Claude Desktop — double-click the .mcpb from GitHub releases, or merge into");
+        out((setup.clients.desktopConfigPath ?? desktopConfigPath()) + ":\n");
+        out(buildDesktopSnippet(setup, "full"));
+        const n = listAvailableSkills(resolveSkillsDir()).length;
+        out(`\nClaude Code skills (${n}): install with  npm run install-skills  (or re-run this wizard in a terminal to choose which).`);
+        out("\nOnce connected, run the `doctor` tool to see which tools your keys unlock.");
+        return;
+    }
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     try {
         const choice = (await rl.question("\nSet up for: [1] Claude Code  [2] Claude Desktop  [3] both  [q] quit > ")).trim();
         if (choice === "q")
             return;
-        const profile = (await rl.question("Profile [full=all 63 tools | balanced | code_focus] (default: full) > ")).trim() || "full";
+        const profile = (await rl.question("Profile [full=all 64 tools | balanced | code_focus] (default: full) > ")).trim() || "full";
         if (choice === "1" || choice === "3") {
             out("\n— Claude Code — run this (fill in your real keys):\n");
             out(buildClaudeCodeCommand(setup));
@@ -117,6 +189,27 @@ export async function runInitWizard() {
             out(buildDesktopSnippet(setup, profile));
             out("\nThen restart Claude Desktop.");
         }
+        // Skills — Claude Code slash commands, opt-in with per-skill skip.
+        const skillsDir = resolveSkillsDir();
+        const available = listAvailableSkills(skillsDir);
+        if (available.length > 0 && choice !== "2") {
+            const target = path.join(os.homedir(), ".claude", "skills");
+            const ans = (await rl.question(`\nInstall ${available.length} Claude Code skills to ${target}? [Enter]=all · [s]=choose which to skip · [n]=none > `)).trim().toLowerCase();
+            if (ans !== "n") {
+                let chosen = available.map((s) => s.name);
+                if (ans === "s") {
+                    out("");
+                    available.forEach((s, i) => out(`  ${String(i + 1).padStart(2)}. /${s.name} — ${s.description}`));
+                    const skip = parseSkipSelection((await rl.question("\nSkip which? (comma-separated numbers, blank = skip none) > ")).trim(), available.length);
+                    chosen = available.filter((_, i) => !skip.has(i)).map((s) => s.name);
+                }
+                const installed = installSkills(chosen, skillsDir, target);
+                out(`\n✓ Installed ${installed.length} skill${installed.length === 1 ? "" : "s"}: ${installed.map((n) => "/" + n).join(", ")}`);
+                const skipped = available.filter((s) => !installed.includes(s.name));
+                if (skipped.length)
+                    out(`  Skipped: ${skipped.map((s) => "/" + s.name).join(", ")}`);
+            }
+        }
         out("\nFirst thing to run once connected: the `doctor` tool — it shows which tools your keys unlock.");
     }
     finally {

package/dist/src/tools/provider-catalog.js

@@ -143,6 +143,8 @@ export const SKILLS = [
     { name: "redteam", desc: "Adversarial plan red-team (pre-mortem, risks, edits)" },
     { name: "spec", desc: "Loose request to reviewable spec before planning" },
     { name: "triage", desc: "Ranked root-cause bug triage from an error/trace" },
+    { name: "test", desc: "Generate runnable tests (edge cases first) via testgen" },
+    { name: "audit", desc: "Security review: OWASP/CWE findings + fixes via security_review" },
     { name: "setup", desc: "Guided configuration — runs doctor, walks keys/profiles" },
     { name: "tachi", desc: "Help & discovery" },
 ];

package/package.json

@@ -2,7 +2,7 @@
   "name": "tachibot-mcp",
   "mcpName": "io.github.byPawel/tachibot-mcp",
   "displayName": "TachiBot MCP - Universal AI Orchestrator",
-  "version": "2.26.0",
+  "version": "2.26.1",
   "type": "module",
   "main": "dist/src/server.js",
   "bin": {
@@ -47,7 +47,8 @@
     "package:extension": "npm run build && ./scripts/package-extension.sh",
     "build:mcpb": "npm run package:extension",
     "verify": "node scripts/verify-installation.js",
-    "postinstall": "bash scripts/install-skills.sh 2>/dev/null || true",
+    "postinstall": "node scripts/postinstall-hint.js || true",
+    "install-skills": "bash scripts/install-skills.sh",
     "add-tool": "plop tool",
     "test:golden": "node --experimental-vm-modules node_modules/jest/bin/jest.js test/golden",
     "test:smoke": "node --experimental-vm-modules node_modules/jest/bin/jest.js test/smoke"

package/skills/audit/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: audit
+description: Use when the user wants a security review of code or a diff — OWASP/CWE findings with severity, taint/data-flow analysis, and concrete fixes via security_review
+user-invocable: true
+---
+
+# /audit — Security Review
+
+Run a dedicated security audit with the `security_review` tool — it carries an attacker mental model (taint/data-flow, OWASP/CWE), not a generic code review.
+
+## Steps
+
+1. Scope the review: a diff (paste it, or `git diff`) to check changed code only, or `code` / `files` for a whole component.
+2. Add what sharpens it: `language`/framework, and `context` for the trust boundaries (e.g. "public internet-facing API", "internal service behind VPN", "handles untrusted uploads").
+3. Choose `standard`: `owasp`, `cwe`, or `both` (default).
+4. Call `security_review({ code | diff | files, language?, context?, standard? })`.
+5. Relay findings led by the highest severity — each has a CWE/OWASP ref, a short exploitability sketch, and a concrete fix. Offer to apply the top fix.
+
+For code you are authorized to review. Requires OPENROUTER_API_KEY. If the tool returns its missing-key error, relay it and suggest /setup.

package/skills/test/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: test
+description: Use when the user wants tests generated for code or a diff — enumerates edge cases and failure modes first, then emits runnable test code via testgen
+user-invocable: true
+---
+
+# /test — Generate Tests
+
+Generate runnable tests for code with the `testgen` tool (a coding-specialized model that lists edge cases before writing tests).
+
+## Steps
+
+1. Collect the code under test. If the user pointed at files, pass them via `files` (use `path:start-end` line ranges for large files). Otherwise take the pasted `code`.
+2. Infer the test framework from the project (jest / vitest / pytest / go test / …) or ask, and pass it as `framework`. If there are existing tests nearby, paste one via `existingTests` so the generated tests match your conventions.
+3. Pick the coverage focus from intent: `edge` (boundaries + failure modes), `happy` (main paths), `regression` (lock current behavior), or `all` (default).
+4. Call `testgen({ code | files, framework?, coverage?, existingTests? })`.
+5. Relay the generated test file, then offer to write it to the right path and run it.
+
+Requires OPENROUTER_API_KEY. If the tool returns its missing-key error, relay it and suggest /setup.