What's New
Security Fix
- Credential-deny symlink bypass (CRITICAL): Symlinks to sensitive files now correctly blocked via readlinkSync + realpathSync resolution
Hook Health Ledger
- New hook-health.ts shared module - every instrumented hook reports success/failure/duration
- 5 critical hooks instrumented: credential-deny, intent-classifier, model-router, skill-compounder, skill-curator
- vibeco doctor --runtime shows 24h execution stats with broken hook detection
CI Quality Gates
- TypeScript type check (tsc --noEmit) now runs in CI
- Dist parity check ensures committed hooks/dist/ matches source
Marketplace
- marketplace.json for plugin ecosystem discovery
- npm + marketplace badges in README
Naming Cleanup
- 50 prompt.md files renamed to SKILL.md
- 8 snake_case skill directories converted to kebab-case
- accessibility-auditor merged into a11y-expert
Numbers
138 agents, 295 skills, 73 hooks, 20 rules
Full Changelog: v3.2.0...v3.3.0