v0.2.0

Buy vs Build grows from "don't reinvent it" into a full decision system: pick the right tool, research what you adopt, adapt to your project, and leave a trail — across every agent.

New capabilities

• Picks the right tool, not the flashy one. A fit-over-reputation rule + the $buy-vs-build skill match the option to the requirement (SSE vs WebSockets, SQL vs NoSQL, cron vs queue), instead of the most powerful/popular/familiar default.
• Researches a dependency before you own it — for any language. The new $buy-vs-build-dependency skill applies a best-in-class checklist (Russ Cox's "Our Software Dependency Problem"; the OpenSSF "Concise Guide"), and scripts/dependency-report.js pulls automatable health/security signals from keyless public APIs (deps.dev / OpenSSF Scorecard, OSV, npm) for npm, PyPI, Go, Maven, Cargo, NuGet, and RubyGems.
• Adapts to your project. Drop a .buyvsbuild.json to weight security/speed, ban or prefer dependencies, and mark what's core; the SessionStart hook injects it.
• Leaves an audit trail. $buy-vs-build-adr + scripts/record-decision.js capture decisions as durable ADRs in docs/decisions/.
• Catches risky deps in review. A PR-review GitHub Action flags new dependencies added without a decision note (advisory).
• Proves it works. A 13-case behavior benchmark (Codex + Claude, with an optional rubric-based LLM judge). Latest Claude run on a small model: baseline 33/65 → enabled 55/65 (+22).

Maintenance & infrastructure

• Single-source generator (npm run sync): edit rules/buy-vs-build.md once; every per-agent copy and the marketplace mirror regenerate. CI enforces it.
• CI runs npm test on Node 20 & 22; added Code of Conduct, security policy, issue/PR templates, and CODEOWNERS.
• README refocused on the problems solved.

Zero runtime dependencies. Same rule, every host: Codex, Claude Code, Gemini, Cursor, GitHub Copilot, Windsurf, Cline, Kiro, OpenCode, OpenClaw.