v1.11.0 — bundle Meshy MCP at tier 3 (needs MESHY_API_KEY)

[1.11.0] — 2026-05-05

Added

• Meshy MCP server bundled at tier 3 (@meshy-ai/meshy-mcp-server). Provides 3D model generation: text-to-3D, image-to-3D, multi-image-to-3D, retexture, remesh, rigging, animation. Used by the art-director agent for 3D-asset scaffolding. Server stanza ships in .mcp.json with MESHY_API_KEY declared as an environment passthrough — the user only has to export the key in their shell and append "meshy" to enabledMcpjsonServers in settings.local.json to opt in. Key obtainable at https://www.meshy.ai/api.

Changed

• README "MCP servers" section now distinguishes two tier-3 sub-cases:
  • Bundled, needs API key (meshy) — stanza ships in .mcp.json, user supplies env var.
  • External, BYO config (elevenlabs, pixellab, comfyui) — stanza NOT shipped because the package/key/self-hosted backend varies per user.
• mcp-meta.json schema extended: each server entry may now carry an optional credential block (env, required, where_to_get) and a note field documenting bundling rationale. Added the corresponding entry for meshy.
• settings.local.json.example comment updated to mention the new tier-3 opt-in flow.

Why

• The art-director agent previously had no first-party route to generate placeholder 3D meshes — projects that needed a 3D character or prop fell back to manual asset hunting or hand-modeling. Meshy AI's API covers the full text/image-to-3D + remesh + rig pipeline, and its MCP server has a canonical npm package, so bundling it is low-risk. Tier 3 is the right slot: it's optional, requires user-supplied credentials, and downstream skills must still gracefully degrade when the server is absent.

v1.10.0 — audit fix campaign (1.6.0–1.10.0 consolidated)

[1.10.0] — 2026-05-05

Added

• scripts/hooks/_lib.sh — shared helper sourced by every PostToolUse hook script. Provides _hook_normalize_path that rebases relative path entries from CLAUDE_FILE_PATHS onto $CLAUDE_PROJECT_DIR before any [ -f ] / [ -d ] test. Prevents silent skipped checks when the runtime cwd is not aligned with the project root. (audit Doc2 #1)
• scripts/validate.sh allowed-tools enforcement — every skill must now declare allowed-tools in frontmatter unless it is on the explicit ALLOWED_TOOLS_EXEMPT list (using-godot-superpowers, subagent-dev-mode, game-brainstorming). Validator FAILs on missing field for any other skill. Closes the documentation gap that let four foundation skills ship without the allowed-tools constraint that all other skills observed. (audit AUDIT.md #1)
• README.md "Portability across clients" section — lists which tool-name primitives map across Claude Code / Copilot CLI / Cursor / Codex, and is explicit that hooks + MCP wiring are Claude Code conventions and do not transfer 1:1. (audit Doc3 portability)

Fixed

• Hook scripts (scripts/hooks/dep-integrity.sh, verifier-reminder.sh, check-tscn.sh, gdformat-gd.sh) now source _lib.sh and call _hook_normalize_path after the trim step, before the file-existence test. Closes the path-normalization gap from audit Doc2 #1.
• agents/game-designer.md callout tension — the agent carries the standard "Authoritative source" callout and says "don't write GDScript code or class names" further down. Added a follow-up blockquote that makes the resolution explicit: design docs cite Resource names, system concepts, and version claims, and those must remain API-accurate even when no code is emitted. The rule is "verify named-API claims," not "verify only when shipping code." (audit AUDIT.md #2)
• skills/subagent-dev-mode/SKILL.md Researcher row — Explore model column changed from hardcoded sonnet to IDE default. The host's default for the built-in Explore subagent can change between Claude Code releases; hardcoding a model name was a forward-compat hazard. (audit Doc4 2.2)
• Caveman-mode references marked optional in skills/subagent-dev-mode/SKILL.md (line 105) and agents/orchestrator.md (line 144) — the feature is provided by the external superpowers plugin and was previously cited without the dependency note. Drop-in users without that plugin would have read it as a documented behavior of this plugin. (audit Doc3 + Doc4 2.1)

Changed

• scripts/validate.sh count drift detection rewritten — replaced indiscriminate [0-9]+ skills / [0-9]+ subagents regex (which matched any prose mention of those numbers) with check_count_anchored that targets only canonical positions: CLAUDE.md tree comments + ## Skill catalog (N) / ## Agent catalog (N) headers, README.md ### N skills / ### N subagents H3 headers, and the marketplace.json description prefix. Each anchor regex contains a single (...) capture group; bash =~ + BASH_REMATCH[1] extracts the number. No more false positives from prose. (audit Doc3 validator)
• scripts/validate.sh exempt-set DRY — extracted the design-only-skill list (skills that never emit Godot 4.x API) into a single DESIGN_ONLY_SKILLS array used by both the callout-presence skip and the callout-absence enforcement loops. Adding a new design-only skill is now a one-line edit instead of two. Same refactor introduces a tiny _in_array helper. (audit Doc3 validator DRY)
• CHANGELOG.md 1.6.0 / 1.7.0 / 1.8.0 backfilled — three placeholder "undocumented maintenance" entries replaced with one consolidated [1.6.0] – [1.8.0] entry that lists the cumulative deltas (2 new agents, 4 new skills, hook script extraction, orchestrator integration step) reconstructed by diffing the v1.5.0 git tag against the v1.8.1 working tree. Per-version assignment is documented as unrecoverable from git. Going-forward rule: every version bump must land with a tagged commit and a dedicated changelog entry. (audit AUDIT.md #3)

Why

• Audit pass identified medium / low residual issues: silent path-handling failure mode in hooks, fragile validator regex that could mask real drift, validator inconsistency around allowed-tools coverage, doc references to optional external features without dependency notes, hardcoded model name that drifts with the host, and three placeholder CHANGELOG entries that gave no context for any regression that traced to that range. None individually critical; together they degraded the plugin's self-describability and resilience to upstream changes. This release is corrective + tooling — no new skills, no new agents.

v1.5.0 — feature-mode trail (codebase-survey + feature-spec + feature-plan)

[1.5.0] — 2026-05-05

Added

• Feature-mode trail (trail B) for changes on top of an existing game, parallel to the existing greenfield trail (game-brainstorming → gdd-writer → writing-game-plan). Three new design-gate skills, gated by user approval, hard-block implementation skills until approved:
  • codebase-survey — read-only mapping of scenes / scripts / autoloads / resources / signals a planned feature will touch. Output: docs/features/<YYYY-MM-DD>-<slug>-survey.md. Captures public API, integration points (signal subscribers, callers), regression hotspots (3+ refs), and [OPEN] questions for the spec.
  • feature-spec — surgical design doc for one bounded feature. Output: docs/features/<YYYY-MM-DD>-<slug>-feature.md. Sections: Problem / Player-facing change / Scope IN / Scope OUT / Integration / New mechanics ([HYPOTHESIS] template reused from gdd-writer) / Regression risks / Acceptance criteria / Tuning numbers / Rollback plan / Open questions. Includes a trivial-feature shortcut (one-file changes can skip survey + most sections).
  • feature-plan — milestone-based technical plan from spec + survey. Output: docs/plans/<YYYY-MM-DD>-<slug>-feature-plan.md. Required tables: Files create / Files edit / Files delete; mandatory regression-test plan tied to survey hotspots; <orchestrator-state> placeholder. Sequencing rules require regression tests against current behavior BEFORE feature integration.
• Orchestrator now accepts either trail. agents/orchestrator.md "Hard preconditions" section restated as Path A (greenfield: GDD + plan) OR Path B (feature: spec + feature-plan). Decomposition heuristics gain feature-mode rows. The <orchestrator-state> block path now resolves to the active plan file (whole-game -plan.md or feature -feature-plan.md).
• Validator path-convention check: scripts/validate.sh now verifies that each feature-trail skill body cites its canonical output path verbatim — drift between skill body and convention fails the build.
• Validator skip list extended: codebase-survey, feature-spec, and feature-plan are exempt from the "Authoritative source" callout requirement (design-only skills, never emit Godot code), consistent with game-brainstorming / writing-game-plan / gdd-writer / update-docs / using-godot-superpowers.

Changed

• using-godot-superpowers dispatcher now routes design requests across two named trails (A — greenfield, B — feature on existing game) with explicit trigger-phrase tables and an updated "Order of operations" diagram. The auto-loaded paths glob list adds *-feature.md, *-feature-plan.md, *-survey.md.
• update-docs cross-check extended to the feature artefact set: surveys, specs, and feature plans are now part of the read-baseline; cross-checks include "Files: edit" path existence, acceptance-criterion ↔ PROGRESS coverage, regression-test presence per hotspot, and promotion of confirmed [HYPOTHESIS] mechanics from spec into the GDD.
• README catalog and CLAUDE.md Skill catalog updated from 26 → 29 skills. The three new skills sit under "Design gates" alongside the existing greenfield gates, with the trail (A vs B) labelled per skill.
• marketplace.json plugin description mentions the new feature-mode trail in addition to subagent dev mode.

Why

• Bounded changes need a bounded design surface. Forcing a full GDD + whole-game plan for "add a double jump" creates friction so high that users skip the design gate entirely and bypass file-verifier discipline. The feature trail keeps the gate in place but scopes the artefacts to the actual delta.
• Existing-game features fail because of integration, not invention. Most rework comes from a new mechanic colliding with an existing signal subscriber or autoload contract. The mandatory survey step makes that integration surface explicit before the spec commits to a solution.
• Orchestrator resumability across paths. With the same <YYYY-MM-DD>-<slug> prefix used by survey, spec, and feature-plan (matching the greenfield prefix used by GDD + plan), the orchestrator state block remains a single deterministic resume point regardless of which trail produced the plan.
• Test discipline before integration. Writing a regression test against current behavior FIRST captures pre-feature truth — flipping the order would let the new behavior re-baseline the assertion silently, defeating the test.

v1.4.0 — unified design artifact paths, validator hardening, security tightening

Added

• Unified GDD / plan file convention: every GDD lives at docs/design/<YYYY-MM-DD>-<slug>-gdd.md, every plan at docs/plans/<YYYY-MM-DD>-<slug>-plan.md. gdd-writer, update-docs, writing-game-plan, game-brainstorming, game-designer, orchestrator, and subagent-dev-mode now all reference the same paths — no more GDD.md at root or docs/<game>-*.md ambiguity.
• settings.local.json.example: tracked install template for the per-user MCP enable file. Drop-in instructions copy it to .claude/settings.local.json. The actual settings.local.json stays gitignored.
• .claude-plugin/mcp-meta.json: sidecar describing tier + purpose per MCP server. Keeps .mcp.json strict to the MCP schema (no _tier / _purpose / _comment keys inline) so a stricter loader cannot reject the config.
• Plugin / marketplace version coherence check in scripts/validate.sh: refuses to PASS if .claude-plugin/plugin.json and .claude-plugin/marketplace.json drift apart.
• Tier-3 MCP availability callout on art-director and sound-designer agents: pixellab / comfyui / elevenlabs are explicitly NOT bundled in .mcp.json, agents detect availability at runtime, fall back to placeholders + free CC0 sources, and say so in their report.

Changed

• art-director semantics aligned across dispatcher, agent, README, CLAUDE.md: every surface now describes the agent as asset generation (PixelLab / ComfyUI MCP when available, placeholders + free CC0 otherwise). The dispatcher previously labelled it "planning-only", which contradicted the agent body.
• MoveComponent in create-component is now genre-agnostic: gravity, jump shaping, coyote / buffer windows, wall jump, and dash were leaking from genre-pack-platformer into the foundation skill. create-component ships only the generic 2D mover; platformer feel lives exclusively in genre-pack-platformer (PlatformerMoveComponent). A new "Genre specializations" table points readers to the matching pack.
• README catalog re-aligned with skill frontmatter: setup-collision-layers now mentions the 11-layer scheme; create-scene lists every template (player, enemy, level, main menu, pause menu, HUD, inventory, dialogue); genre packs include wall jump / dash / twin-stick aim / dodge roll / animation tree / deterministic RNG.
• README "Conventions enforced" added the missing rules already present in CLAUDE.md: Parallax2D (4.3+) over ParallaxBackground / ParallaxLayer, Resource save (not JSON), _unhandled_input over _input.
• .tscn validation hook wording in README + CLAUDE.md now matches the actual command: godot --headless --check-only --path "$CLAUDE_PROJECT_DIR" <file> (only the first 5 lines of output are surfaced).
• settings.local.json.example MCP-enable semantics: dropped enableAllProjectMcpServers: true to remove the ambiguity of pairing a "enable everything" flag with a partial whitelist. The file now uses an explicit enabledMcpjsonServers whitelist of tier-1 servers; tier-2 (git, memory) is opt-in.
• plugin.json author is now Simone Tarantino (with URL), matching marketplace.json owner and plugins[0].author. Previously listed as godot-superpowers contributors, which contradicted the marketplace metadata.
• CI: removed the redundant inline "Verify hooks parity" step from .github/workflows/validate.yml. scripts/validate.sh already runs the parity check; CI now invokes the validator only.
• scripts/validate.sh JSON validity: now covers .claude-plugin/marketplace.json, .claude-plugin/mcp-meta.json, and settings.local.json.example (required); settings.local.json is treated as optional with a clear SKIP line so a fresh clone (where the file is gitignored) does not fail validation.
• scripts/sync-hooks.sh comment clarified: plugin-mode reads hooks/hooks.json by Claude Code convention, not because plugin.json declares it.

Fixed

• marketplace.json plugin description referenced the obsolete "verifier reminder" wording — replaced with "file-verifier dispatch reminder", consistent with the live hook output and the validator's own anti-drift check.
• CLAUDE.md Layout section now accurately documents what plugin.json actually declares (skills + mcpServers only) versus what is auto-discovered by Claude Code's plugin-mode convention (agents/, hooks/hooks.json).
• subagent-dev-mode skill: removed Italian phrase 'modalità subagentica' from description and the trigger list. Repository content is English-only per CLAUDE.md policy; localized phrasings belong in language packs.

Security

• PreToolUse Bash hook tightened: in addition to the existing destructive shell patterns (rm -rf /, sudo rm, :(){ :|:& };:, mkfs, etc.), the hook now blocks destructive git commands without explicit user confirmation: git reset --hard, git clean -f*, git checkout ., git checkout -- ., git restore ., git push --force / git push -f, git branch -D, git reflog expire --expire=now, git gc --prune=now. Settings allowed Bash(git *) blanket, which left these history-rewriting / working-tree-destroying commands unfiltered.

Why

• One source of truth for design artifacts: with three competing path conventions, plans were sometimes written under docs/<game>-plan.md and read from docs/plans/..., breaking resume scenarios. Unified path makes the orchestrator's <orchestrator-state> block resumable across sessions.
• Onboarding under a fresh clone: settings.local.json is gitignored, so the README's cp ... settings.local.json ... command was broken on day 1. The tracked .example template plus updated copy instructions resolve it.
• Schema stability for .mcp.json: stripping _* annotations keeps the config compatible with strict-mode loaders without losing the human-readable tier metadata, which now lives in the sidecar.
• Foundation skills must stay genre-agnostic (per the existing CLAUDE.md editing rule). The platformer logic in create-component was a regression of that rule.
• Destructive git is the most common irreversible action Claude can take with Bash(git *) allowed. Adding it to the deny regex matches the same threat-model as the existing shell-destructive patterns.

v1.3.1 — orchestrator fixes + verifier MCP-down rule + CI

Patch release. Verified external feedback (orchestrator inefficiency, MCP/README drift, multilingual gap) and added own high-priority fixes (retry cap, MCP-down downgrade, CI).

Fixed

• Orchestrator — dropped non-portable TodoWrite from declared tools; added Edit + Write. The orchestrator now updates plan markdown directly instead of dispatching a worker for every checkbox flip.
• Orchestrator — hard retry cap: max 2 fix-passes per file after CRITICAL verifier finding, then escalate. Prevents infinite verify→fix loops.
• File verifier — MCP-down downgrade rule: when godot-docs MCP is unavailable, every API-correctness finding drops from CRITICAL to WARNING; only syntactic Godot 3.x leftovers + missing type hints stay CRITICAL.
• Verifier-reminder hook — skips when running inside a subagent (CLAUDE_AGENT_NAME set), and emits one consolidated line for all changed files instead of one per file.
• .mcp.json — added git and memory servers at tier 2, matching README. memory recommended for orchestrator state persistence.

Added

• Plan state block schema — canonical <orchestrator-state> block (milestone, phase, pending/in_progress/completed, fix_passes, last_updated) at the top of docs/<game>-plan.md. Read on resume; no chat-history re-derivation.
• Language directive — orchestrator's final batch report matches the user's chat language; file paths, severity tags, and code stay verbatim. Repo content stays English-only.
• CI — .github/workflows/validate.yml runs scripts/validate.sh + hook-parity check on every push and PR to main.

Rejected (verified incorrect)

• "Plugin manifest needs agents and hooks keys" — would re-introduce the agents: Invalid input and Duplicate hooks file detected errors fixed in v1.0.1. Both directories are auto-discovered by convention; the manifest must NOT reference them.
• "Agent tool uses agent_name, not subagent_type" — current Claude Code schema uses subagent_type. Confirmed against the live tool definition.

Install / upgrade

/plugin marketplace update godot-superpowers
/plugin install godot-superpowers@godot-superpowers

v1.3.0 — Subagent dev mode (orchestrator + file-verifier)

Added

• orchestrator agent (sonnet) — decomposes a milestone into independent worker tasks, dispatches workers + file-verifier in parallel, aggregates ≤200-word summaries. Never writes code. Hard-requires approved GDD + plan + named milestone.
• file-verifier agent (haiku) — external semantic check on a single Godot file after every Edit/Write. Reads file fresh (no writer-context pollution), queries godot-docs MCP, returns CRITICAL/WARNING/INFO findings only. Does not rewrite.
• subagent-dev-mode skill — documents the orchestrator + worker + verifier loop, activation triggers, token-discipline tactics, anti-patterns. Activates on "implement milestone X", "subagent mode", "modalità subagentica", and similar.
• Verifier-reminder hook — PostToolUse Edit|Write on .gd / .tscn / .tres / .gdshader prints verifier reminder: dispatch file-verifier agent on <path>. Visible reminder so the verifier is not skipped.
• Verification rule in using-godot-superpowers — every write to a Godot source file must be followed by a file-verifier dispatch. Applies whether or not subagent dev mode is active.

Why

• Token discipline — workers and verifier run in isolated context, main-context Claude only ingests short summaries. Milestones with 5+ files no longer balloon the main context.
• Correctness — every written file is independently re-read and checked against the live godot-docs MCP before being considered done. Catches API drift the writer's pre-trained knowledge would miss.

Catalogs

• 26 skills (was 25)
• 13 subagents (was 11)

Install / upgrade

/plugin marketplace update godot-superpowers
/plugin install godot-superpowers@godot-superpowers

If the marketplace is cached:

/plugin marketplace remove godot-superpowers
/plugin marketplace add Simone-Tarantino/godot-superpowers
/plugin install godot-superpowers@godot-superpowers

v1.2.0 — godot-docs MCP authoritative source

Every skill and agent now points to godot-docs MCP as the authoritative source for Godot 4.x APIs. See CHANGELOG.md.

v1.1.0 — Design-gate skills

Adds brainstorming, game-plan, and dispatcher skills. See CHANGELOG.md.

v1.0.1 — Manifest fixes

Fixes plugin manifest validation. See CHANGELOG.md.

v1.0.0 — Initial release

[1.0.0] — 2026-05-04

Initial release.

Added

• Plugin manifest (.claude-plugin/plugin.json) linking skills, agents, hooks, and MCP servers.
• 22 skills across foundation, scaffolding, quality, content, build, and four genre packs (platformer, top-down, 3D action, turn-based).
• 11 subagents covering review, scene architecture, design, QA, audio, art, performance, export, addons, migration, and playtest analysis.
• Hooks: gdformat on .gd write, godot --check-only on .tscn write, gdlint on stop, destructive Bash blocker, Godot version check on session start.
• Recommended MCP servers (godot-mcp, godot-docs, context7).
• Repo tooling: scripts/sync-hooks.sh (mirrors settings.json hooks → hooks/hooks.json) and scripts/validate.sh (JSON, hook parity, frontmatter, broken links).