v0.13.2

Added

• expand languages, output formats, and distribution hardening

Added

• --format junit for skillpack verify: JUnit XML for xUnit-consuming CI
  (GitLab CI, Jenkins, CircleCI).
• --format json for skillpack add (parity with init/update/diff).
• marketplace_category and owner_type overrides in skillpack.toml — the
  marketplace category and owner.type fields are no longer hardcoded.
• Nix, Dart/Flutter, and Haskell language detection (plus category/globs
  hints), widening introspect beyond the original 13 languages.
• A multi-skill pack's marketplace entry now merges every skill's keywords.
• A published JSON Schema for the verify --format json report
  (verify-report.schema.json).
• The reusable skillpack.yml workflow now emits --format github
  annotations; the release pipeline gained an install.sh smoke job, and the
  Homebrew formula pins per-platform sha256 (re-pinned via
  scripts/update_homebrew_sha256.py).

Fixed

• update/diff now detect skillpack-generated single-file targets
  (AGENTS.md, CLAUDE.md, GEMINI.md, CONVENTIONS.md,
  .goose/instructions.md, .github/copilot-instructions.md) instead of
  silently dropping them from the default target set; the collision guard is
  content-aware (a clean generated file is tracked, a divergent one is held).
• verify --watch now reports unrecoverable errors with INIT_FATAL (3),
  matching the standalone verify path.

v0.13.1

Added

• expand agent ecosystem coverage and power-user tooling

Fixed

• harden distribution assets and default refresh to present targets
• harden verify, config, and add against silent corruption

Added

• Native Claude Code skills directory: the Claude target now also emits
  .claude/skills/<name>/SKILL.md (auto-loaded with no plugin install step).
• Four new ecosystem targets: Cline (.clinerules/<name>.md), Roo Code
  (.roo/rules/<name>.md), Kilo Code (.kilocode/rules/<name>.md), and
  Goose (.goose/instructions.md) — --target all now covers 14 formats.
• skillpack add <name>: append a skill to an existing pack (interview or
  --non-interactive bootstrap) and regenerate.
• --target list: print the canonical --target values.
• --format json for init/update/diff: machine-readable summaries for CI.
• verify --format github: GitHub Actions ::error/::warning annotations
  for inline PR-diff comments.
• skillpack config + config --validate: summarize/validate the committed
  skillpack.toml; a JSON Schema ships at skillpack.schema.json.
• Derived-field overrides in skillpack.toml: allowed_tools, category,
  globs, opencode_mode, and keywords can pin the language-derived values.
• Polyglot monorepo detection: introspect records secondary_languages and
  init --auto emits one skill per detected language.
• One-command install.sh + a Homebrew formula (homebrew/skillpack.rb) and a
  static x86_64-unknown-linux-musl release binary.

Fixed

• init re-running on a hand-authored [[skills]] pack no longer collapses it
  to the primary skill (it now renders every skill).
• Subcommand capture now honors a total --help spawn budget (breadth cap),
  truncating wide CLIs instead of forking thousands of probes.
• Subcommand parsing now recognizes cobra (Available Commands:) and argparse
  ({cmd1,cmd2} usage) help shapes, not just clap.
• command_from_documented no longer reads surrounding prose as the program
  name (a secondary skill used to resolve to CLI `The`).
• Version drift now genuinely tolerates a CLI that prints --version and
  exits non-zero (captured output is carried through RanNonZero).

v0.13.0

Added

• Recursive subcommand capture: init walks nested subcommands (git remote add)
  and renders them as indented ### Subcommands bullets; verify recursively
  drift-checks every documented subcommand path.
• Structured logging: --log-level (off/error/warn/info/debug/trace) and
  --log-format (human/json) route spawn calls and introspection traces through
  tracing; --debug is now an alias for --log-level debug.

Changed

• ProjectProfile.cli_subcommand_help is replaced by the recursive
  cli_subcommand_tree: Vec<SubcommandNode> (breaking for library and
  doctor --format json consumers).
• VerifyInput.debug / InvocationInput.debug removed; spawn logging now flows
  through the structured logger (breaking for library consumers).
• verify::invocation::extract_documented_subcommands returns Vec<Vec<String>>
  subcommand paths instead of Vec<String> (breaking for library consumers).

v0.12.1

Fixed

• address review findings across CI, docs, and source

Other

• production-readiness pass from the second review
• remove em dashes from README
• center the Built with Freebuff heading
• rerun benchmark with 3 runs per condition
• rewrite agent-demo for Google Antigravity (agy) + Gemini 3.7 Flash
• switch benchmark to Google Antigravity (agy) + Gemini 3.7 Flash
• drop duplicate skillpack h1 from hero (wordmark is in the logo)
• add Freebuff CTA banner and drop emoji from section headers

No unreleased changes yet.

v0.12.0

Added

• Repeatable OpenCode benchmark harness (scripts/benchmark/): run.sh
  runs an A/B of a plain repo clone vs init --auto --target all output
  through OpenCode — same repo, same default agent, same model, same
  questions (the old demo's --agent confound is gone). analyze.py
  evidence-scores each question and reports per-condition medians across
  --runs N. Uses opencode's configured model by default; pin with
  --model. First committed results (fd, glm-5.2, 2 runs/condition):
  −32% agent steps, −44% wall clock, −6% tokens, 3.5/4 → 4/4 correct.

Fixed

• init --auto README hint no longer leaks badge/markup rows (shields.io,
  CI status, language links) into the derived description — read_readme_hint
  now skips lines that are markup-only, so a repo like fd whose README leads
  with a badge banner gets the real tagline (previously the description
  became a badge URL and the generated pack failed verify at 93/100).
• verify's description_action_verb check accepts descriptions that open
  with a code-formatted name (`fd` is a program to ...) — the leading
  backtick pair is stripped before the alpha-word heuristic. Markup/badge
  leakage still fails.

Added

• init --auto: zero-flag, zero-prompt init. The intent is derived entirely
  from the repo — description from the README hint, author from the manifest
  or git config user.name, license from the LICENSE file (or --license),
  invocation from the detected CLI. --import is required for libraries
  (actionable error otherwise); --trigger is optional (falls back to the
  description hint). Implies non-interactive: on a critical verification
  failure it refuses to write (exit 2) instead of prompting.
• Four new harness targets, bringing the total to ten: claude-md
  (CLAUDE.md — Claude Code / Cline / Roo Code), gemini (GEMINI.md —
  Gemini CLI, per the official docs), windsurf (.windsurf/rules/<name>.md
  — same frontmatter schema as Cursor rules), and aider (CONVENTIONS.md).
  The three plain-markdown targets share the copilot/AGENTS.md structural
  check (now a single shared implementation); Windsurf reuses the Cursor
  rule check with its own check_id prefix. AGENTS.md coverage is documented
  for Freebuff and 60k+ projects' agents.

Added

• Multi-skill packs (the documented future direction, now shipped): a
  [[skills]] array in skillpack.toml renders one per-skill file per
  ecosystem (skills/<name>/SKILL.md, .codex/skills/<name>/SKILL.md,
  .cursor/rules/<name>.mdc, .opencode/agents/<name>.md), each under its
  own directory name and with its own frontmatter. The [skill] table stays
  the PRIMARY skill — pack-level files (plugin.json, marketplace.json,
  AGENTS.md, copilot-instructions.md) render from it, and hand-adding a
  [[skills]] entry keeps it primary. update/diff/verify --fix are all
  multi-skill aware: verify accepts any configured skill name in the
  name_drift check, and --fix splices the RIGHT skill's frontmatter while
  preserving every body. The config normalizes to a [[skills]] array on
  first update. Author the array by hand; init still writes single-skill
  packs. Docs: docs/reference.md "Multi-skill packs" section.

Added

• init --non-interactive can now bootstrap the FIRST pack from flags
  (--description, --trigger, --author, --invocation or --import)
  when no skillpack.toml exists — previously a chicken-and-egg: CI needed a
  committed config, which needed an interactive run. A fresh checkout can now
  be scaffolded end-to-end with no TTY: skillpack init --non-interactive --description ... --trigger ... --invocation .... Missing required fields
  fail with an actionable message naming the flag; passing both
  --invocation and --import is rejected. With a committed config the
  flags are ignored (config wins), so re-runs stay deterministic.

Fixed

• .gitignore now excludes .freebuff/ — the desktop-app local database was
  being swept into the crates.io tarball (cargo package includes untracked,
  non-ignored files). Private local data would have shipped with the crate.
• All 11 rustdoc warnings eliminated (stale GeneratedFile links, links to
  private items, an unclosed HTML tag, a redundant link target) — cargo doc
  is now warning-free.
• release.yml now runs cargo audit before cargo publish, so a
  vulnerability disclosed after the last main CI run blocks publishing.

Added

• Language support expanded to five more ecosystems — Zig
  (build.zig/build.zig.zon + zig-out/bin/), Swift (Package.swift
  • .build/{debug,release}/ artifacts or swift run), C / C++
    (CMakeLists.txt, meson.build, Makefile and build/ / bin/
    binaries), Elixir (mix.exs + _build/{dev,prod}/rel/ releases or
    mix escript), and Deno (deno.json / deno.jsonc + deno run
    entrypoints) — bringing the supported language count to thirteen.
    Detection, manifest parsing, CLI candidates, Cursor globs, and snapshot
    coverage all extended.

Fixed

• detect_repo_url now preserves the raw git remote get-url origin
  string (what lands in plugin.json homepage / repository) while
  urls_equivalent still compares normalized forms — so a trailing-slash
  or .git-suffix difference no longer causes false URL drift, and the
  committed plugin.json keeps the exact origin URL.
• The Go CLI candidate test compares the binary file stem
  case-insensitively (matching the Node test pattern) — fixes a
  windows-latest-only failure where PATHEXT resolves go to a path ending
  in go.EXE.

Changed

• README rewritten to be user-facing: plain-language quick start, "what you
  get" per ecosystem, and a measured-results section up front. The full
  check list, every CLI flag, and the platform notes moved to the new
  docs/reference.md, which the README links to.
• Declared MSRV raised to Rust 1.85 (rust-version in Cargo.toml), matching
  what the locked clap/tera actually require — cargo install on Rust
  1.74–1.84 previously failed with a hard toolchain error. README badge and
  toolchain comment updated; CI gains an MSRV job that checks lib + bins at
  1.85.0 so the floor can't drift again.
• Removed three unused direct dependencies (thiserror, walkdir,
  indexmap) — they had zero references in src/ and only bloated compile
  time and the lockfile.

Added

• New verify discovery checks: an unterminated --- frontmatter block in a
  SKILL.md / cursor .mdc / opencode agent file now FAILs (*.frontmatter_unclosed)
  instead of being silently parsed as valid frontmatter with the body swallowed;
  a skills/<name>/SKILL.md (or .codex/skills/<name>/SKILL.md) whose directory
  name disagrees with its frontmatter name: warns (*.dir_name_mismatch).
• discovery.plugin.url_drift now reports BOTH homepage and repository
  drifts in one warning — the old early return hid a second stale field.
• CI gains a cargo audit job (RustSec advisory scan of the lockfile).
• update/diff now honor the global --verbose/--debug flags (they were
  silently ignored).
• update no longer rewrites skillpack.toml when its serialized content is
  unchanged (no mtime churn); uses the same frontmatter-splice semantics.
• The interview accepts semicolons as trigger-phrase separators (was
  comma-only).
• release.yml reads the crate version from the [package] table only — the
  old ^version grep would break if a workspace-level version line ever
  appeared.

Fixed

• HELP_TIMEOUT raised 15s → 30s: the Windows CI go run . round trip timed
  out again under parallel-test load (the same flake that raised it 8s → 15s
  previously). The go round-trip test now also pre-warms the build cache
  before init, mirroring the rust-cli / csharp fixtures.