Conquistador 0.12.0 — broader routing, messaging facts, and the growth playbook

Conquistador 0.12.0 adds a workflow for distilling outside marketing knowledge, a growth playbook, broader routing for everyday marketing and sales requests, messaging compliance facts, and more writing checks.

Changes

• Requests for popups, dunning and cancel flows, lead scoring, tracking plans, attribution, schema, keyword cannibalization, content decay, internal links, media lists, and battle cards now reach the right command. On 455 sample requests, misroutes fall from 323 to 214, and no request that routed correctly before changed.
• A request that names SMS or WhatsApp now loads dated facts on US consent, opt-out, quiet hours, 10DLC registration, and the WhatsApp template window. No drafting rules are added.
• Search facts are corrected: Google retired HowTo rich results in 2023 and FAQ rich results in May 2026. Disavow applies only with a manual action. The App Store keyword limit can count bytes in non-Latin scripts.
• conquistador check has eleven new post-draft rules. They catch negation lists, stock transformation lines, erased effort, generic hooks, stock email openers, decorated Unicode letters, engagement bait, empty comments, performed cleverness, verb bullets, and intensifier clusters. The drafting guide is unchanged.
• docs/GROWTH-PLAYBOOK.md maps marketing, growth, and sales as one system. It covers stage guides, the binding stage, a channel atlas, search triage, motions by business model, sales, measurement, and compliance.
• For contributors, tools/distill.mjs pins permissively licensed sources at exact commits, maps their units to routes, and checks that public text is in our own words.

No method craft changed. Practices keep their thin entries until a human blind test shows that a rule improves the output.

Install or update

npx conquistador@latest

To pin this release:

npx conquistador@0.12.0

Server apps can use npm install @forsvn/conquistador@0.12.0. Bun users can use bunx conquistador@0.12.0.

Scope

This remains a public alpha. Deterministic checks and installed-package verification establish loading and installation behavior. They do not establish marketing output quality or retrieval compliance in external chat apps. The host supplies the model, context, tools, and permissions. Dated platform and legal facts were checked in October 2026; confirm them before you rely on them.

This package release does not redeploy the hosted MCP Worker. Composio account acceptance and the existing native-client and provider limitations remain as documented in STATUS.md.

Conquistador 0.11.0 — thin guidance across every entry point

Conquistador 0.11.0 gives agents shorter guidance for marketing tasks across the CLI, app API, skills, plugins, MCP, specialist assignments, and upload-only bot packs.

Changes

• Marketing practices without a winning human comparison use a short entry. The agent works from the user's facts and checks unsupported claims after drafting. Full method files remain available for explicit reads and future evaluation.
• Outbound, social, sales-page and sales-letter copy, engineering, utilities, and kept plays retain their methods.
• Requests with pasted background now follow the named deliverable. Pricing, experiment, channel, and budget decisions reach the method that owns the decision.
• The evaluation tools support blind draft generation, a practice registry, reasons for human choices, and extended sessions that do not require judging the same pairs again.
• A verified search snapshot reduces repeated indexing. All install routes share the same method policy.

For the explicit pricing app request, the rendered prompt drops from 53,749 to 1,189 UTF-8 bytes. Creative drops from 80,033 to 1,593, and campaign from 80,359 to 1,172. Tested outbound, social, sales-page, and build prompts keep the same context sizes. These measurements describe prompt bytes, not model latency or output quality.

Install or update

npx conquistador@latest

To pin this release:

npx conquistador@0.11.0

Server apps can use npm install @forsvn/conquistador@0.11.0. Bun users can use bunx conquistador@0.11.0.

Scope

This remains a public alpha. Deterministic checks and installed-package verification establish loading and installation behavior. They do not establish marketing output quality or retrieval compliance in external chat apps. The host supplies the model, context, tools, and permissions.

This package release does not redeploy the hosted MCP Worker. Composio account acceptance and the existing native-client and provider limitations remain as documented in STATUS.md.

Conquistador 0.10.2 — simpler setup

Setup now follows Agents → Review → Install → Done. More options are available from Review; desktop MCP clients, Executor, chat exports, hosted MCP, and permanent CLI installation are opt-in.

Detected agents appear first. The full catalog remains available, with search and keyboard help. Review leads with a plain summary and keeps commands behind Details. Home groups advanced controls under Settings and extra integrations under Connect apps.

Start with npx conquistador@latest. Standalone MCP remains npx conquistador@latest mcp.

Validation: Linux and Windows installed-package CI, Node 22.18/24/26 and Bun app integration, and product checks passed on PR #92. Local installed-package verification passed 50 executed checks, including 22 real-agent interactive checks in isolated homes. Fixture tests do not establish live provider acceptance.

This release changes the installer and package metadata. Hosted MCP remains the previously verified 0.10.1 deployment.

Conquistador 0.10.1

Conquistador 0.10.1 simplifies setup across coding agents and MCP clients.

• Start with npx conquistador@latest; a global install is optional.
• Use standalone MCP without activating skills or hooks.
• Configure only Executor with npx conquistador@latest mcp install --executor.
• Follow the runnable Composio Custom MCP example for OAuth/API-key registration, account connection, discovery, resync, and read verification. It previews requests before applying them.

All release-candidate CI checks passed. The hosted Worker is updated and real authenticated Executor calls verify engineering-task silence and focused outreach guidance. Composio is implemented against documented API v3.1 and SDK 0.27.0 with local checks; no live Composio account acceptance is claimed.

The seven attached assets are built from the tagged merge commit. SHA256SUMS and assembly.json bind their bytes and source. The trusted-publishing workflow publishes the exact paired npm tarballs with provenance.

Conquistador 0.10.0: task-scoped guidance

Conquistador now scopes guidance to the work you requested and reduces unnecessary context.

• Engineering tasks that mention outreach, sales, or marketing no longer trigger unrelated playbooks.
• Small edits receive compact assistance. Commands and workflows load current-stage guidance, with detailed resources available on demand.
• Automatic hooks are advisory. Verified transcript reads can suppress repeated advice; context rotation or changed resources restores it.
• Native and project hooks share admission and disable rules. Edit checks require a declared channel or an active marketing task.
• Installed skill entry points no longer require every Core resource or a playbook appendix.

Manual activation remains the installed default. An explicitly enabled project prompt hook can opt into automatic guidance. Off remains final.

Validation: all 12 PR checks passed, including Node 24/26 product checks, installer E2E, and installed app integration. Local verification includes 969 source tests before release preparation, 40 targeted release tests, 142 routing cases, and the strict 13-request behavior audit. These checks do not establish model quality or native-host delivery in every supported client.

The hosted service is not updated by this package release. Use the published package or update the installed plugin through its owning host.

Source: ba4d078. Check SHA256SUMS and assembly.json against the attached archives. The assembly record binds source and bytes; its UNBOUND classification is not a model-quality claim.

Conquistador 0.9.1 — MCP safety and framing performance

Conquistador 0.9.1 hardens MCP file reads and upload recovery, and reduces copying when stdio messages arrive in small chunks.

• Briefs use the same contained, bounded file reader as direct reads. Replaced symlinks, binary files, invalid UTF-8 and oversized files are rejected after the ranking cache is warm.
• Fragmented stdio frames are assembled once. In five alternating paired benchmark rounds, the 64 KB one-byte-chunk workload fell from a 179.91 ms median to 43.08 ms (35 samples per version; standard deviation 22.36 ms to 6.46 ms). Small frames showed no speed benefit. Brief validation adds filesystem work; this is not a claim about overall task latency.
• MCP request-body failures return a generic HTTP 400; oversized requests return HTTP 413 without waiting for stalled or rejected cancellation. Healthy retries remain usable, and authentication precedes body reads.
• Patch development-only Vite/Vitest tooling and add 21 regression tests plus a repeatable performance harness.

Validation includes 963 public tests, 54 focused MCP regressions, 38 checks each for actual npm and Bun consumers, 67 terminal installer checks, and 27 fixture OAuth/Worker/browser checks on each of Node 24 and 26. The review used isolated homes, synthetic identities and local services with no paid model calls.

See PR #84 and the review report for exact coverage, measurements and limits. Existing repository-wide lint diagnostics and the isolated optional Promptfoo node-forge advisory remain. Live provider/native-host acceptance is not established. The hosted MCP deployment is unchanged because its existing credential was refused during baseline verification.

The seven attached artifacts are assembled from the tagged merge commit. SHA256SUMS covers the five distributable archives; assembly.json records the source commit and package identities. The paired npm packages use this version together: @forsvn/conquistador@0.9.1 and conquistador@0.9.1.

Conquistador 0.9.0 — Executor v2 support and runtime refresh

Conquistador 0.9.0 adds Executor v2 app management and capability verification, while retaining supported v1 connections.

• Install, update, verify, and remove owned Executor v2 apps without changing connected accounts. Edited or unowned app source is preserved.
• Discover capabilities through MCP and verify one reviewed read. Saved verification binds the selected target, credential identity, and tool description.
• Use the updated Eve sandbox and skill APIs, with complete text references, size limits, and path containment.
• Refresh optional Executor/Eve dependencies and the isolated Promptfoo runtime.

Verification covers 942 product checks, the full PR installation matrix, 15 real isolated native Executor v2 cases including the public GitHub callback, 21 Eve contracts, a prepared Eve app build and native HTTP checks, and exact package identity. Hosted account evidence covers the existing linked Conquistador account. Paid Eve model jobs and other provider accounts require separate acceptance.

The required Promptfoo dependency graph has no audit findings. Three high findings remain in its optional, unpatched node-forge/jks-js chain. Live evaluation execution stays disabled by default. See evals/README.md for the scope and repeatable checks.

The seven attached assets include the paired npm tarballs, complete source ZIP, prepared skill/plugin ZIPs, SHA256SUMS, and assembly.json. The release workflow publishes the checked tarballs through GitHub OIDC with provenance.

Install the CLI with npx conquistador@latest. Apps use @forsvn/conquistador@0.9.0.

Conquistador 0.8.0 — four installation methods and MCP OAuth

Conquistador 0.8.0 simplifies installation to four methods: Skills, CLI, MCP, and Plugins.

• Install project skills with the Skills CLI or npx conquistador skills.
• Run the reviewed agent installer with npx conquistador install. Apps keep the typed production dependency.
• Use npx conquistador mcp for stdio, mcp install for client setup, or connect to the hosted MCP URL with OAuth or an API key.
• Use npx conquistador plugins for supported native plugin clients, or download the prepared plugin bundle for compatible clients.

Hosted OAuth adds GitHub sign-in, S256 PKCE, client registration and metadata discovery, resource-bound tokens, refresh, and revocation. Personal API keys retain their separate lifecycle. The new conquistador npm package pins the matching main package; it has no lifecycle scripts.

Verification includes the product suite, isolated CLI and package installs, a real-terminal plugin boundary check, and 27 workerd/browser OAuth checks. The OAuth E2E suite uses a labeled local GitHub identity fixture. Real GitHub sign-in, a read-only tool call, and Cancel passed in hosted Executor v2. Other native-client activation remains tracked in ROADMAP.md. See INSTALL.md for setup and the installation acceptance guide for repeatable checks.

The seven attached assets include both npm tarballs, the complete source ZIP, prepared skill/plugin ZIPs, SHA256SUMS, and assembly.json. Check the checksums before installing from an archive.

Conquistador 0.7.0: use it inside your app

Conquistador 0.7.0 adds a typed library for agents in your app.

Install it in your project:

npm i @forsvn/conquistador

Use createConquistador() to call the eight bundled marketing tools. Import @forsvn/conquistador/mcp to mount the same tools on your Node server or Fetch handler. Your app supplies the model, project facts, authentication, and approval flow. Imports and dependency installation do not start a model or TUI.

The CLI and TUI now include a Use in an app guide. Global npm and Bun installation still opens the installer with one command. Public HTTP bindings require a token; MCP handlers check Origins, protocol headers, and request size.

App integration guide · Runnable app example

Verification passes 940 product checks, 65 terminal scenarios, and 36 installed-app checks on each of npm, Bun, and Node 22.18.0. The npm tarball matches the accepted candidate exactly. CI passes Node 24/26, Linux/Windows installation, and all four installed-app toolchains.

This library supports server-side Node and Bun. Browser and Edge runtimes, native MCP client loading, and real writing-quality acceptance need separate verification. Hosted MCP continues to use bearer tokens; OAuth is not included in this release.

Conquistador 0.6.1

Install Conquistador and open its TUI with one command:

npm i -g @forsvn/conquistador@latest && conquistador

With Bun:

bun add --global @forsvn/conquistador@latest && conquistador

The command stays available for agent, skill, MCP, hook, update, and repair controls. The TUI option now says "Keep the CLI installed". Explicit npx @forsvn/conquistador@latest remains available for a single run. The README and documentation use the same setup order. They also expose native plugins, project skills, local and hosted MCP, chat bot files, GitHub bundles, and the manual Executor 2 handoff. Agent and MCP client selections support multiple checkboxes.

This patch follows 0.6.0, which added the complete 16-agent picker and independent selections. All product, plugin, host, and portable-agent version metadata is 0.6.1.

Verified with 940 product checks, 64 terminal scenarios, 50 package checks including 21 native terminal checks, and six real npm/Bun install-and-open checks. The shared bilingual website chooser passes 628 browser checks, including 198 setup checks. Copy and social checks test recorded rules; they do not establish writing quality. Native MCP client loading, Executor 2 execution, interactive Windows, and Node 22.18 package-command acceptance remain open.