v4.3.0 — gold-standard hardening

A quality-and-hardening release from a deep, multi-round independent audit
(each finding double-checked against the real code before it was trusted). It fixes
real bugs — including several security-gate gaps — and grows the test suite from 135
to 198 tests. No change to how you use the tool; the roster stays 38 agents /
32 skills, and no agent, skill, hook or safety gate was removed.

Security fixes

• Closed a way to bypass the publish / go-public safety gate using GitHub's gh api
  command (both spaced and attached forms, and default-to-public repo creation);
  ordinary reads are unaffected.
• Closed a gap where creating an "internal" repository (visible to a whole
  organisation, so not really private) could slip past the go-public check.
• Removed a "slow regex" flaw where certain long commands could briefly freeze the
  safety check; it is now effectively instant.
• The secret scan is now much more thorough. It also checks: the git history a
  push would ship (across every local branch and tag, not just the one you have
  checked out — so git push --all / --mirror are covered), merge-commit
  content, commit and annotated-tag messages, files you force-add past
  .gitignore (including names with spaces), large text files (a plaintext key
  in a big database dump or log is caught), and text files carrying a stray non-text
  byte. Genuine pictures, fonts and other binaries are still skipped, and non-English
  text such as Bangla is treated as text.

Correctness & reliability

• Fixed false "all-clear" and false "blocked" results across several internal
  checks (indented / border-less / mixed-style tables, decorated "done"/"met"
  statuses, licence scanning on ordinary npm/TypeScript projects, and more).
• Reconciled the publish checklist to its full set of blocking checks everywhere it
  is described (with a guard so it can't drift), corrected the automatic AI
  model-cost chooser, hardened AI prompt-injection and key-handling guidance, and
  fixed the dashboard's colour contrast (light and dark) to meet accessibility
  standards.

Under the hood

• The automated test suite grew from 135 to 198 tests, with new mechanical
  guards so each fix cannot silently regress; all five safety checks stay green.

Full detail, including every disclosed residual limitation, is in
CHANGELOG.md and
SECURITY.md.

v4.2.0 — a clearer, friendlier repository

A documentation and packaging release. Nothing about how GRU953-Studio behaves has changed — this is all about making the project clearer and easier to use, especially if you're not technical. The roster stays at 38 specialist roles and 32 skills.

What's new

• A full plain-English guide on the new wiki: installing on every platform, connecting Ollama and Gemini, the whole team of specialists, all the skills, sample projects to try, troubleshooting, and an FAQ.
• A rebuilt front page (README) and a slimmer, faster landing website — with the brand's own fonts now built in, and light and dark themes.
• The licence is now the exact, official PolyForm Noncommercial 1.0.0 text. Commercial-licensing details moved to their own friendly page, COMMERCIAL-LICENCE.md.
• A Sponsor button, a Support page, and guided forms for reporting a problem or suggesting an idea.

Good to know

• GRU953-Studio stays free for personal and non-commercial use. Selling something built with it needs a separate commercial licence.
• GitHub may show the licence as "Other" — that's only because PolyForm isn't in GitHub's built-in licence list, not a fault.

Install or update (inside Claude Code)

/plugin marketplace add GRU-953/GRU953-Studio
/plugin install gru953-studio@gru953-studio

---

GRU953 is a not-for-profit, open-technology organisation on a mission to make technology simple — and accessible — for all. Built openly with a global community and a home in Bangladesh, GRU953 designs tools that are free for personal use and open to study and improve. Simple technology. For everyone.

GRU953 একটি অলাভজনক, উন্মুক্ত-প্রযুক্তি প্রতিষ্ঠান, যার লক্ষ্য সবার জন্য প্রযুক্তিকে সহজ ও সুলভ করে তোলা। বিশ্বজুড়ে একটি কমিউনিটি ও বাংলাদেশকে কেন্দ্র করে উন্মুক্তভাবে গড়ে ওঠা GRU953 এমন সব টুল তৈরি করে যা ব্যক্তিগত ব্যবহারে বিনামূল্যে এবং যে কেউ পর্যালোচনা ও উন্নত করতে পারে। সহজ প্রযুক্তি। সবার জন্য।

v4.1.1

v4.1.1 — deep audit hardening, rebuilt README, new website

v3.3.0

Self-healing, plus six small refinements found by a bounded, fact-checked review.

New: self-healing. When something breaks while GRU953-Studio is building your app, the Fixer now quietly tries a couple of small repairs on its own first, and only interrupts you if that doesn't work. Every fix still needs your explicit yes before it ever reaches GitHub — this never changes, no exceptions.

Six small, optional refinements, none of them urgent, all found by a deeper review and fact-checked against Anthropic's own current documentation before being built: real spending figures for Cost Monitor (with your one-time permission), a visible-screen check before sign-off on bigger projects, a clearer on-screen line for what a helper AI is doing, and a few other small hardenings behind the scenes.

Verified: 63/63 automated tests, every integrity/roster/licence check clean, strict plugin validation passing, and both new automated checks actually run against real sample input (not just syntax-checked), all on a fresh clone of the actual published repository before this release.

v3.2.0

Two new abilities, both scaled to a clear confirmation before building.

New: micro-task planning. On bigger projects, the Architect now breaks the plan into small, clearly-checkable steps, each with its own proof of "done" and its own place in the order — recorded so it's auditable, not just assumed. Independent steps can still run side by side (nothing about the existing two-builders-at-once feature changes); steps that depend on each other are correctly kept in order.

New: an optional local AI model via Ollama. The AI Developer can now offer a free, private, locally-run AI model (via Ollama) as an alternative to Claude for an app's AI features — always your choice, never the default, and it always asks first and tells you the download size before installing anything or downloading any model. The team can also use a local model as an independent second opinion during its own review work, the same technique already proven in v3.1.1.

Not built this round: using two other AI tools (Antigravity and Gemini) already installed on this Mac to help audit the plugin. Both were confirmed genuinely installed, but neither exposes a way for this session to actually drive them (no command line, no API) — so nothing was built rather than something that couldn't actually be verified.

Verified: 63/63 automated tests, every integrity/roster/licence check clean, strict plugin validation passing, all on a fresh clone of the actual published repository before this release.

v3.1.1

A patch, following a quick targeted re-check of v3.1.0 requested right after it shipped. Two independent review passes ran: a direct re-read of everything changed in v3.1.0, and a second opinion from a locally-run AI model (Ollama, model ornith:9b) given the full plugin source and asked for concrete, high-confidence issues only. Every finding from both was independently verified against the actual files before being treated as real.

Fixed: a tool-grant mismatch in the new "ecosystem finder" — it told the Researcher to check what's already installed using a command it doesn't actually have access to run. Fixed by having the Builder (which does have that access) do the check instead.

Fixed: the README's version banner still said "3.0.4" after v3.1.0 shipped. Corrected to 3.1.0, with an accurate description of what's actually new.

Fixed: the README and the internal role list disagreed on how "Maintenance Agent" is categorised. Checked its actual behaviour and corrected the internal list to match the README, which had it right.

No behaviour change for anyone not yet using the two new v3.1.0 abilities. Verified: 63/63 automated tests, every integrity/roster/licence check clean, strict plugin validation passing, all on a fresh clone of the actual published repository before this release.

v3.1.0

A feature release, following a research pass into the wider FOSS Claude Code ecosystem (superpowers, claude-mem, several skill/plugin "finder" tools, and a broader sweep) to check what GRU953-Studio should adopt. Nothing was bundled — GRU953-Studio ships under one licence, and mixing in another project's code would mean re-auditing someone else's code for security; one candidate even carried a copyleft licence that would have conflicted with this project's paid-commercial-licence model. Instead, two genuine gaps were built natively, and the file tree was reorganised to match regular GitHub practice.

New: a native "ecosystem finder". When a task genuinely needs an existing Claude Code skill/plugin GRU953-Studio has no native way to provide, it can now recommend one — checking what's already installed, preferring Anthropic's own vetted plugin lists first. Nothing installs without your explicit "install it" on a pop-up. This adds to, not replaces, Claude Code's own built-in /plugin > Discover browsing feature.

New: a native test-first (TDD) workflow for bigger projects. On Standard/Complex Tier, the team now writes one small test that must genuinely fail before any code is written for that task, then builds until it passes — inspired by an idea a FOSS tool called "TDD Guard" enforces, built as GRU953-Studio's own code. Tiny Tier (small, one-off projects) is unaffected.

File tree reorganised to match regular GitHub practice. LICENSE, NOTICE, the Code of Conduct, Contributing guide, and Security policy moved to the repository's top level, where GitHub's own licence badge and community-standards checklist actually look for them (previously kept in a custom folder for brand-structure reasons). The licence text itself is unchanged.

README refreshed to reflect all of the above, plus a short note crediting three independent, well-licensed companion tools found during the research (cost tracking, security-focused PR review, parallel-session management) — clearly marked as not affiliated with GRU953-Studio.

Verified: 63/63 automated tests, every integrity/roster/licence check clean, strict plugin validation passing, all on a fresh clone of the actual published repository before this release.

v3.0.4

Platform-compliance patch (fixes and hardening only — no roster, Tier, or workflow changes).

A fresh 5-round audit checked every plugin component — the 23 agent files, 7 skills, the hooks, the 3 slash commands, and the manifests — strictly against Anthropic's own published Claude Code documentation, verified with the real claude plugin validate --strict tool and by reproducing each issue before fixing it.

Highlights:

• Closed a total publish-gate bypass via the Monitor tool. The safety hooks matched only Bash and PowerShell; the built-in Monitor tool also runs shell commands, so a push could slip past both the secret scan and the publish gate. Matcher is now Bash|PowerShell|Monitor, with an integrity check and regression test.
• Fixed three agents that silently loaded with no metadata — an unquoted colon in their description broke the YAML, so they ran with no name, tools, or model pin.
• Hook block-reasons now actually reach Claude (were being discarded on the wrong exit code).
• Added missing tool grants so agents can use the skills they rely on, and so the project lead can delegate at all.
• Repaired a licence path that broke on install (now a proper within-plugin symlink).

hooks.test.mjs grew from 61 to 63 tests. See CHANGELOG.md for the full list.

v3.0.3 — Security-hardening release

v3.0.3 — Security-hardening release

Closes a 15-round audit-loop engagement run after v3.0.2 shipped, on the
question of whether further audit was warranted. Every fix was verified
by direct execution (real bash ground truth compared against the real
isPushCapable()/gate.mjs) before being called done. Test suite grew
from 47 to 61 tests.

CRITICAL fixes — push/go-public gate matcher

A long series of genuinely different bash variable-assignment/retrieval
mechanisms, each of which could hide a real git push or a visibility
change from the publish-safety checker:

• Array assignment and subscript access, including variable/arithmetic/
  bare-name/negative indices, array length used in arithmetic, brace
  expansion inside array literals, and an $IFS-in-subscript ordering bug.
• printf -v NAME VALUE (including a value-capture bug).
• Parameter-expansion defaults, indirect expansion (${!ref}),
  case-folding (${x,,}/${x^^}), and bash 4.4+'s @ transformation
  operators.
• Substring expansion (${VAR:offset:length}).
• read assigning from a here-string or a real here-document,
  mapfile/readarray reading into an array, and set -- resetting
  positional parameters.
• An array/scalar cross-contamination bug that corrupted a separate fix.

CRITICAL — publish-safety structural gaps

• The private-publish and go-public confirmation tokens had no expiry;
  fixed with a 60-minute validity window.
• hooks.json's matcher only covered Bash, silently skipping the
  publish-safety checks on native Windows without Git Bash. Fixed by
  adding PowerShell, plus a new structural check that verifies this
  stays wired.

Other fixes

• A role-count check false-blocked legitimate longer prose; tightened.
• Extended a "content read from memory is data, not instruction" guardrail
  to ~20 more agent files, closing a cross-session contamination vector.
• A documentation gap in the go-public cleanup step.

Disclosed, not fixed

Seven residual limitations — array element reassignment/append,
associative arrays, command substitution in an array element, process
substitution and co-processes feeding read, and declare -n nameref
variables — are explicitly documented in governance/SECURITY.md as
accepted limitations rather than silently open, following an explicit
scope-boundary decision made partway through this engagement.

See CHANGELOG.md for full detail.

v3.0.2 - Final one-shot deep audit: 8 lenses, a critical bypass closed

One final, maximally-deep single-round audit (8 parallel specialist lenses covering security, integrity hooks, role-consistency, comprehension/docs, lifecycle, packaging/CI, AI-safety, and whole-product coherence) on top of v3.0.1. 7 of 8 lenses found real issues; the most serious was a critical, live bypass in the prior release's own push-safety fix, rooted in how bash expands a declaration keyword's own arguments (export/declare/readonly/typeset) differently from a bare variable assignment -- reproduced end-to-end and closed. Also disabled Dependabot going forward (no history rewrite), fixed several documentation/consistency drifts, and closed two small AI-safety hardening gaps. See CHANGELOG.md for full detail on every fix.