v2.2.3

2.2.3 (2026-10-06)

⚠ BREAKING CHANGES

• advanced-evaluation, context-degradation, codebase-advisor and agent-browser are removed and no longer install through npx skills add --skill <name>; use evaluation, context-optimization and codebase-design.
• rename the grilling primitive to grill-me (#211)
• drop MongoDB/Mongoose skills and standardize on Prisma/Postgres and Vitest (#208)
• biome-validator, bun-validator, clerk-validator, nextjs-validator and tailwind-validator are removed; use stack-validator.
• skills: grill-me, refactor-dispatch, changelog-generator, github-address-comments, typescript-refactor, spec-first and fullstack-workspace-init are removed.
• grill-me, refactor-dispatch, changelog-generator, github-address-comments, typescript-refactor, spec-first and fullstack-workspace-init are removed.
• commands: the deploy skill and plugin are renamed deploy-app.
• systematic-debugging, execution-debugging, context-fundamentals, and ai-regression-testing are removed.
• release-pr-gates and release-dispatch are removed; use release.

Features

• add grill-me alias for grilling (#174) (d97c8be), closes #172
• commands: add picker frontmatter and a standard help mode (#170) (4a5dbf3)
• executing-plans: slim executor brief and deterministic plan-header check (#156) (a0f9899)
• pstack-sync: declare ignored repo-only upstream paths (#191) (01d63a5)
• pstack: adopt open-pstack runner reliability bundle (#200) (86da8a6)
• pstack: sync upstream 0.15.x content and advance pinned sources (#198) (3dc4588)
• pstack: weekly upstream drift check workflow (#209) (f49aa5f)
• retro: add session retrospective and fold pstack reflect into it (#187) (b0cc749)
• skills: add wayfinder, research, triage mode and interview send mode (#199) (cbd8bf3)
• skills: fold Pocock duplicates into the catalog and unify the PR body template (#193) (2c49ff7)
• skills: hide internal engines from the slash menu (#173) (1b6f248)
• skills: port Pocock debug, routing and glossary upgrades (#196) (da8dcb7)
• standup: add all-author recap and merged-history audit (#161) (bea4c5d)
• upstream-drift: one weekly drift check and aggregate issue for every upstream (#227) (332e092)

Bug Fixes

• artifacts-builder: close the CSS injection, snapshot before inlining, and resync the CSS tokenizer (#260) (52221a6)
• artifacts-builder: decode HTML character references in inliner attribute values (#250) (bf54798)
• artifacts-builder: guard existing destinations, preserve bundles, inline public assets, strict Node check (#241) (45fd2c7), closes #239
• artifacts-builder: harden the asset inliner against symlink escapes and malformed HTML (#245) (53c794a), closes #243
• artifacts-builder: harden the inliner with a CSS tokenizer, srcset descriptors, DOM-faithful output and file confinement (#253) (a0df314)
• commands: route every command to a skill the model can load (#177) (7b2afbb)
• executing-plans: run helper CLIs when invoked through a symlinked install (#220) (6f15d8b), closes #218
• git-cleanup: align merged-head guidance and proof receipts (#264) (90f4131)
• git-cleanup: audit ancestor deletions that trunk restored (#182) (597ed96)
• git-cleanup: catch directory links inside the removed worktree in duplicate chains (#221) (796f27f)
• git-cleanup: clear merged worktrees that real cleanup runs still kept (#194) (7a6ea0e)
• git-cleanup: clear Studio test checkouts without manual handling (#206) (72b2935)
• git-cleanup: remove merged exact PR heads that trunk later edited (#186) (8ccce1e)
• git-cleanup: remove pointer branches, copied ignored files and worktree branches in one pass (#184) (dc8e38a)
• git-cleanup: resolve symlink targets in duplicate check; report supersession triage (#217) (ecfbd25)
• git-cleanup: treat an unfetched PR merge commit as missing evidence (#159) (c019c54)
• git-cleanup: verify current trunk code and intent before deletion (#163) (9f80997)
• micro-landing-builder: AA defaults, AA-safe text, template and CSV theme support (#254) (30cf8be)
• micro-landing-builder: confine slugs, pair theme foreground with background, unique input ids (#246) (5391e62)
• micro-landing-builder: infer theme mode from background brightness (#249) (15f6c18)
• micro-landing-builder: opaque hover, AA link text, robust batch input (#259) (85f0a59)
• micro-landing-builder: pick theme foregrounds by WCAG contrast and validate theme colors (#252) (c031873)
• micro-landing-builder: validate complete themes and rendered states (#263) (f75f53b)
• planning: package executing-plans with the planning bundle (#213) (bd1b0e3)
• project-init-orchestrator: accept several frontend origins and verify the API image in CI (#229) (ee3b80e)
• project-init-orchestrator: reject wildcard origins and inspect the builder stage in CI (#233) (7af8af8)
• project-init-orchestrator: secure generated collections and Docker image, fix auth/session and setup bugs (#228) (709f7ab)
• pstack-drift: handle truncated compares, renames, governance token and issue lookup (#215) (dd3a6d4)
• pstack-drift: scope truncated fallback by pin..head ancestry (#219) (52008e1)
• release: verify release PR base and uniquely attribute dispatch runs (#214) (89178a7)
• retro: route deep-mode findings to environment fixes (#192) (ff560ea)
• setup-dev-loop: correct PROJECTS_TOKEN scope and permission guidance (#212) (cbd08cf)
• skills: address independent review of #240 (#247) (6ad4e63)
• skills: address post-merge review of #195 and #201 (#203) (10ec20d)
• skills: address post-merge reviews of #189 and #188 PRs (#202) (1df610d)
• skills: artifacts-builder on Bun with shadcn/ui; shadcn and tailwind on Tailwind v4; fold shadcn-setup (#237) (7e41833), closes #235
• skills: keep the trusted Stripe userId authoritative and scan nested lockfiles (#236) (b0277f4)
• skills: replace the dead @agenticindiedev/ui package with shadcn/ui (#242) (2643062)
• skills: restore argument hints and deploy-app contract checks after #177 (#181) (aaf976f)
• standup: bound PR enrichment to frozen window and document toolkit license discrepancy (#216) (fca0bbe)
• upstream-drift: keep tag resolution inside the tracked family; correct impeccable pins (#231) (46bf36f)
• upstream: keep reports available when derived sources disappear (#262) (beaaf74)
• upstream: reconcile tracked sources and port reviewed guidance (#265) (159cad7)
• validate: fail command routes to skills without SKILL.md (#210) (be101ff)

Refactors

• artifacts-builder: rebuild the asset inliner on parse5 and postcss (#251) (7f681c5)
• delete aliases and merge five overlapping skill pairs (#195) (c80ea6e)
• drop MongoDB/Mongoose skills and standardize on Prisma/Postgres and Vitest (#208) (9d43fb0)
• finish scaffold modernization (Better Auth, Tailwind v4, current pins) (#222) (f69e672)
• fold advanced-evaluation, context-degradation, codebase-advisor; drop agent-browser (#240) (e428744), closes #235
• merge overlapping debug, context, and testing skills (#169) (73ae34c)
• merge release-pr-gates and release-dispatch into release (#167) (5b2cf4f)
• merge the five stack validators into stack-validator (#201) (5012944)
• rename the grilling primitive to grill-me (#211) (01e6f6c)
• skills: finish house-stack sweep (Better Auth, Tailwind v4, bun.lock, NestJS 12) (#230) (a1d07e3)
• skills: inline router tables into commands and make routers explicit (#197) (604b9dc)
• trim skill descriptions to the listing budget (#176) (574fe91)

Chores

• align all skills with repository release 2.2.2 (#165) (b8213b0)
• release: bump only the patch version on every release (#180) (0d0c46c)
• skills: remove unused context-engineering and allowlist a synthetic gitleaks fixture (#204) (0533dc0)