Agent Scripts 0.12.0

Highlights

• Turned maintainer-orchestrator into a long-running control plane for autonomous queue triage, proof-driven changes, dependency maintenance, and release proposals across Peter's repositories.
• Added fleet maintenance, safe repository synchronization, package ownership audits, and Xcode fleet management for Peter's Macs.
• Replaced the old Codex review path with isolated structured autoreview and added Claude Code-only codex-first delegation for implementation-heavy work.
• Added scripts/sync-skills so Codex and Claude share one canonical skill and instruction mirror across agent-scripts, manager, and repo-owned skills.
• Hardened 1Password, npm, and macOS release workflows around scoped service access, stable tool identities, noninteractive signing, and verified publication boundaries.

Maintainer Orchestration

• Expanded maintainer-orchestrator with one tracked Codex thread per repository, 30-lane scheduling, durable status, forgotten-work preservation, exact-head landing, dependency sweeps, VISION capture, and release-readiness proposals.
• Added a dedicated OpenClaw mode with root-owned discovery, qualified execution lanes, contributor routing, live permission checks, serialized landing, and OpenClaw-specific proof and changelog rules.
• Added autonomous GitHub queue triage with URL-first item briefs, maintainer-comment routing, author context, live proof requirements, safe spam closure, and explicit Peter decision briefs.
• Added the non-majority repository ledger, owner-maintained crawl-family overrides, and clearer root ownership for orchestration policy and worker titles.
• Made dependency updates, internal operating repositories, bounded cleanup, safe dirty fast-forwards, and candidate-scoped release blockers autonomous.
• Improved ClawSweeper status reporting for worker capacity, exact-review occupancy, workflow waiters, bounded API reads, and accurate failure and closure counts.
• Tightened shared agent policy around exact-head proof, contributor credit, screenshot safety, post-merge recaps, background-task visibility, public mutation, and release authority.

Review and Agent Workflows

• Replaced codex-review with structured autoreview, adding isolated Codex, Claude, and Pi review, safe bundle validation, regression provenance, security checks, parallel tests, and bounded multi-pass review.
• Added Claude Code-only codex-first routing for implementation, fixing, exploration, rebasing, and landing mechanics, including safe use of the ChatGPT app-bundled Codex CLI. Thanks @notorious-d-e-v.
• Added current model, effort, fast-mode, liveness, deterministic resume, and self-delegation guardrails to the Codex workflow.
• Made GitHub deep review and project triage prefer current source, real behavior reproduction, exact PR heads, and factual contributor trust signals.
• Routed screenshot and login-dependent browser work through existing Chrome state, with safe attach recovery and no silent isolated-browser fallback.
• Added explicit compatibility contracts, clean bounded-refactor guidance, generated-code skepticism, and scoped opportunistic cleanup rules.

Fleet, Release, and Remote Operations

• Added fleet-maintenance for host health, package updates, repository synchronization, ownership collisions, disk cleanup, and service-impact reporting.
• Added xcode-sync for signed Xcode inventory, stable and prerelease slot management, build-identity checks, platform compatibility, and verified installation.
• Added dependency-light fleet repo audit and update helpers with batched snapshots, clean fast paths, dirty-work preservation, collision checks, and safe fast-forwards.
• Added release-mac-app and shared macOS release helpers for changelog notes, Sparkle appcasts, signing, notarization, GitHub assets, and post-release verification.
• Hardened macOS releases for passwordless isolated keychains, preloaded secrets, modern distribution validation, Bash 3.2, lightweight tags, bracketed changelog versions, and archive version parsing.
• Refreshed remote-Mac topology and network-boundary guidance, signed local app testing, locked-Mac Git fallback, and Cloudflare-only ClickClack deployment.
• Kept GitHub reads on the Octopool shim and added cache-health recovery before live GitHub fallback.

Credentials and Safety

• Unified 1Password work on one tracked tmux session with scoped service-account access first, consent-gated desktop fallback, exact-field reads, known-item routing, and TCC-safe ~/bin/op updates.
• Unified npm authentication around reusable service sessions, safe field selection, token caching, login fallback, package reservation, publication verification, and a generic authenticated command wrapper.
• Added internal-information, confidentiality, device-aware image upload, API-key storage, and approved-destination guardrails without blocking authorized private research.
• Standardized the canonical test Gmail account, OpenClaw deployment account, personal versus corporate Mac routing, and pre-approved Gmail service login behavior.

Skills and Tools

• Added scripts/sync-skills to build Codex whole-root links, Claude's flat skill mirror, shared instruction pointers, deterministic collision handling, and stale-link pruning.
• Added skills for fleet maintenance, Xcode sync, Codex delegation, Twilio SMS, Wrangler, Things, Reminders, SSH diagnosis, agent transcripts, and shared macOS releases.
• Added skill-cleaner inventory, duplicate, usage, and prompt-budget audits plus isolated --root-only scans. Thanks @its-How.
• Added browser-tools network capture with filtering and follow mode. Thanks @mvanhorn.
• Hardened browser-tools startup, profile copying, symlink handling, and console flags. Thanks @ShiroKSH.
• Fixed xurl's OpenClaw npm installer metadata. Thanks @not-stbenjam.
• Made skill validation explicitly UTF-8-safe under C locales. Thanks @chaochaoweb3.
• Added skills.sh grouping metadata for shared skills. Thanks @vyctorbrzezowski.
• Exposed shared behavior validation, session viewing, crabbox, and crawl-family skills through the canonical mirror while removing duplicated bundled copies.