v0.8.0

Changed

• Skills, subagents, and commands are about 130 words shorter each. The rules for declining a request, stopping for missing inputs, and refusing an instruction embedded in evidence are now three ordered directions under ## Reply paths, kept in one source file and copied into 392 payloads. A reply no longer has to name one of four situation labels.
• Related links now cover most of the catalog: 125 new composesWith pairs, so 118 artifacts that stood alone point to the artifacts they hand work to or receive it from. An artifact whose text names another by slug is always linked to it.
• The thirty subagents that review a set of paths now search before they read: each brief lists the calls, keywords, and file patterns to look for, opens the highest-risk candidates first, and reports the ones it did not open with the search that found them.
• A subagent handed a request that belongs to the neighbour its description names now says so and stops instead of reviewing it.
• Every subagent description now says what sets it apart: the signals in a request that should select it, and the neighbour to use instead (Not for X; use <slug>). Before, 35 of 62 ended with the same sentence, so an agent choosing a specialist had nothing to go on.
• Nine skills that analyze and then change the repository (define-domain-language, debug-systematically, assess-mutation-test-value, build-repository-quality-gates, simplify-code-with-invariants, enforce-typescript-module-boundaries, request-independent-code-review, evaluate-code-review-feedback, verify-completion-evidence) can be asked for the analysis alone: they report, change nothing, and list the changes they would have made as proposals.
• Thirty subagents can review a set of paths as they stand, not only a diff. Without a baseline they derive the missing invariant, contract, or policy from the code, label it inferred, and list every supplied path they did not open, instead of stopping for missing inputs. Their turn budget is up to four turns higher, capped at sixteen.
• Every subagent reports findings in one format: an id, a category, a severity, a confidence, the claim, each cited file as path:start-end, the quoted evidence, what would prove the claim wrong, the impact, and the smallest next action. Severity is one scale (Critical, High, Medium, Low) and confidence is one scale (Demonstrated, Supported, Suspected), so results from several specialists can be merged and sorted. Blocking is no longer a severity, and missing evidence lowers confidence instead of severity.
• Commands state which steps ask for your permission and what happens when you deny one. The tools a command declares are pre-approved for the turn that invokes it; they never limited what the command could run, and the catalog no longer describes them as an allowlist.
• /re-pin-mcp-tools no longer pre-approves file edits. The pre-approval covered only the turn before you confirm the digest, which is the one turn where the command forbids edits.
• Five commands (/preflight-change-environment, /audit-repository-instructions, /assemble-review-brief, /diagnose-ci-failure, /record-work-checkpoint) no longer open with a precondition step that checked nothing.

Fixed

• packs --json and pack-info --json print JSON instead of refusing the flag. With --target, pack-info --json reports installable and blockingMembers.
• pack-info refuses an unknown --target, and says when a pack cannot be installed on the chosen target and which required members block it. pack-info <pack> --target codex previously printed the pack as if it were installable.
• A --cwd that does not exist or is not a directory is refused. doctor --cwd <missing path> answered No state drift found. and add --dry-run answered Would install.
• /verify-session-ledger stops with a clear message when no ledger exists, instead of reporting an empty ledger as verified.
• The counts in catalog/artifacts.json include commands, contexts, and MCP servers, so the per-kind counts add up to the total.
• Subagent profiles for Claude Code, Gemini CLI, and OpenCode carry the turn budget instruction that only the Copilot profiles had, so a specialist that runs out of turns returns partial evidence instead of being cut off.
• application-security-reviewer names the six narrow specialists it routes to by their catalog slug, so the parent agent can dispatch them.
• configuration-semantics-reviewer no longer lists a refusal that described configuration-drift-analyst.
• 34 skills no longer show a one-line description cut off mid-phrase in the Codex skill list.

Integrity

Root digest: f3d6fbb3eee4829d609c9d9147755eb59d75cfb24686245eb120282e59666a25. Compare it with npx @youdede/toolkit verify-integrity.

v0.7.0

Added

• youdede-toolkit search <term...> matches terms against an artifact's name, slug, summary, and refusals, and ranks a result by how many of those fields a term hit. Searching refusals finds an artifact by the thing you want prevented. Every term must match, so each one narrows the result, and every list filter applies to a search as well.
• youdede-toolkit installed lists what the installation state records for a target and scope, including prerequisites that were pulled in and artifacts no longer in the catalog. It answers what is installed, where doctor answers whether what is installed still matches what was recorded.
• youdede-toolkit completion bash|zsh prints a shell completion generated from the same tables the parser uses and from the catalog, so it cannot offer a command, flag, or value the CLI would then refuse. zsh loads the same definition through bashcompinit.
• youdede-toolkit version, and the --version spelling, report the package name and version. --version was previously read as an option expecting a value and exited 1.
• --json on list, search, info, installed, and doctor. The records list and search emit are a stable summary rather than the whole manifest, because catalog/artifacts.json already carries every field.
• --dry-run and --json on remove and remove-pack. The plan names every file that would be deleted, kept because another install also records it, or put back, and whether the settings, MCP configuration, state, and generated notice would be rewritten or removed. It is produced by the removal itself, stopped before its first write, so it cannot describe something other than what would happen, and it takes no installation lock, so it writes nothing at all. It reports the installed artifacts that still need the one being removed instead of refusing over them.
• docs/install.md states the exit codes: 0 when a command answered, 1 when it refused or failed, and what falls under each.

Changed

• doctor accepts --json and keeps exiting 1 when it finds drift. It previously refused the flag, and that refusal was asserted by a test; a drift check that CI runs is the one diagnostic that most needs machine-readable output.
• npm run validate refuses a taxonomy value that no artifact carries. A declared value makes a filter a legitimate question whose answer is always none, which reads as an empty catalog rather than an absent dimension. What the installer and the adapters support — kinds, risk levels, targets, scopes — is not checked against the catalog's contents.
• catalog/taxonomy.json no longer declares the express, fastapi, flask, nestjs, and spring frameworks, which no artifact carried. list --framework express answered 0 artifact(s). with exit 0; it is now refused with the frameworks the catalog does carry.

Fixed

• Secret history scanning reads the git rev-list --objects output that Git actually produced. Git accepts -z and ignores it before 2.47, so on the Git that Debian 12 and Ubuntu 24.04 LTS ship, npm run check:secrets:history stopped with malformed object metadata and the release gate could not run at all.
• A one-dash option is refused instead of being read as a positional word and ignored. add <artifact> -target codex reported installing to Codex' default and wrote to claude-code.
• A word beyond the arguments a command takes is refused. info <artifact> <other-artifact> described the first and ignored the second.
• list refuses a filter value the taxonomy does not carry. list --kind hooks printed 0 artifact(s). and exited 0, so a typo in a script reported an empty catalog.
• info no longer accepts --target, --scope, and --cwd, and pack-info no longer accepts --scope and --cwd. Each was accepted and read by nothing, so naming a target asked a question the answer ignored.
• The multi-file install rollback test states the privilege it needs instead of failing as root, where a directory mode cannot block a write. The case still runs on the runners that gate the suite.

Integrity

Root digest: f525ef52caa89c8c033504e7f0f4c62a349d96ba0a8778831191ce470ef10eeb. Compare it with npx @youdede/toolkit verify-integrity.

v0.6.0

Added

• edit-ai-draft-for-human-voice skill: revises an AI-assisted draft toward a human voice, narrative structure first and style second, following the StoryScope study of AI fiction. A bundled script measures the draft before and after, flags numbers or names the revision added or dropped, and scores a closed-option structural rubric.
• assess-story-narrative-provenance skill: scores a full English story with a narrative classifier (human-like, AI-like, or uncertain), preferring TypeSafe Jev as annotator with an agent-model fallback, and writes a JSON or HTML report with the choices that pulled the score.
• audit-published-content-defects skill: finds the defects readers can see on published pages (visible markdown, unresolved placeholders, double-escaped entities, paragraphs cut after an abbreviation, repeated or untranslated passages) across a page, a sitemap, or saved HTML, fetching politely and stopping when a site blocks, and reports them grouped by kind as JSON, Markdown, or HTML.
• edit-ai-draft-for-human-voice can also write an editorial review: passage-by-passage edits whose quotes are checked against the text and whose suggestions cannot add numbers or names, with a checklist of review questions for any genre.
• PRIVACY.md states that the toolkit collects no data and lists what stays on your computer and what leaves it. Claude Code plugins link it, SUPPORT.md, and the toolkit page for their directory listing.

Integrity

Root digest: f525ef52caa89c8c033504e7f0f4c62a349d96ba0a8778831191ce470ef10eeb. Compare it with npx @youdede/toolkit verify-integrity.

v0.5.0

Added

• Every Claude Code plugin folder ships a README.md that lists its members and states what it runs, so each plugin can be submitted to the Claude plugin directory.
• Every Claude Code plugin carries the Youdede icon for its directory listing.

Changed

• Every pack moves up one patch version, so Claude Code plugins installed from 0.4.0 pick up these changes.
• The remote-review-evidence plugin asks for the GitHub token as a sensitive plugin option, kept in the system keychain, instead of reading GITHUB_PERSONAL_ACCESS_TOKEN from the environment. The npm package homepage is https://youdede.studio/en/toolkit.
• Commands no longer pre-approve Bash in allowed-tools. Claude Code now asks before each shell command a command runs.

Fixed

• Claude Code plugin hook files no longer carry a description key that Claude Code ignores, and plugin.json no longer names the icon that the plugin directory finds by default.
• Claude Code plugins no longer list hooks/hooks.json and .mcp.json in plugin.json. Claude Code loads both files by default and reported a duplicate hooks file.

v0.4.0

Added

• npm run release:prepare derives the next version from the Conventional Commits since the last release and updates the changelog, package.json, package-lock.json, CITATION.cff, and the marketplace manifests.
• mcp-egress-guard blocks a call to a Youdede MCP server whose arguments name a host outside that server's declared egress, including lookalike, subdomain, userinfo, IP, and punycode forms. It binds every MCP tool in Claude Code and ships a preview Cursor adapter; secure-agent-boundaries 1.2.0 includes it.
• Three workflow commands (diagnose-ci-failure, preflight-change-environment, audit-repository-instructions) and four contexts (API, migration, CI, and dependency baselines).
• Preview MCP profiles for the official GitHub server (v1.12.2, read-only reduced toolset) and Playwright MCP (0.0.82, isolated, loopback only), in the new remote-review-evidence and browser-verification packs.
• One shared command parser and capability matcher for every Bash hook (scripts/lib/shared-hook/shell-items.mjs, capability.mjs, inline.mjs). Each hook declares what it protects as a CAPABILITY and sees through wrappers (sudo, env, xargs, find -exec, eval, sh -c), substitutions, here-documents, Git aliases, globs, brace words, and interpreter one-liners such as python3 -c "os.system('npm publish')". A command it cannot read blocks only when it could touch what the hook protects.
• quality/hook-verdicts.json records the verdict of all 64 Claude Code hooks on about 2,500 inputs: hook tests, audit probes, command sequences, and everyday developer commands. npm test fails on a verdict change without a declared reason, and on a verdict that contradicts a reviewed expectation unless it is quarantined with a follow-up.

Changed

• npm run check:readiness no longer requires model-judged semantic evidence to publish. Model replies vary between runs (about one case in eight changed outcome between two near-identical full runs), so a single run cannot fairly pass or fail a release. Semantic evaluation stays as an advisory maintainer test, run after prompt or case changes, and the committed receipt quality/release-evidence/ is removed.
• Links between artifacts have three levels: required prerequisites (the installer asks once, default yes), suggestions (one hint line after an install), and related artifacts (catalog only). Each link has a short reason that the installer prints. catalog/artifacts.json and catalog/packs.json move to schema version 2 and keep every version 1 field; docs/catalog-format.md describes the format.
• Every Bash hook names shell-command-guard as a prerequisite, so a command that hides what it runs (bash -c "$X", curl … | sh) is stopped even when only one hook was requested. add installs it first (--no-prerequisites opts out), remove refuses it while another hook needs it unless --force, and five packs now include it.
• shell-command-guard owns every program a command runs without containing it: network output run by a shell is internet-to-shell, and any other unknown program is uninspectable. Shell setup output (eval "$(pyenv init -)"), local scripts, and static feeds pass. The other hooks leave such programs to it, which removes many false positives.
• The hooks that read what a commit will take inspect git add … && git commit, git commit -am, pathspec commits, and Git aliases instead of refusing or ignoring them. A commit in the same command as git add -f or an alias definition is refused: run them as separate commands.
• Behavioral cases are written for each artifact: a concrete request with its evidence, a near miss that belongs to a neighbouring artifact, a missing input, and a boundary that crosses one of the artifact's refusals. Every skill, subagent, command, and context is covered.
• GitHub Copilot skill adapters and Gemini CLI subagent adapters are stable, following the vendors' documentation (read 2026-09-26). Gemini CLI adapters state that Google stopped serving Gemini CLI on 2026-06-18 for free use and for Google AI Pro and Ultra.
• The Cursor adapters of the three read-only MCP servers are back to preview until the egress guard is verified in a live Cursor client.
• The npm package no longer contains the marketplace copies or the README images: about 1.4 MB instead of 4.8 MB, with identical CLI behavior.
• resume-session-work is published only for Claude Code, the only runtime where its session ledger installs.
• The summaries of mobile-release-readiness, browser-verification, session-continuity, and plan-and-verify-loop state what their members actually check.
• File-editing hooks take the project root from CLAUDE_PROJECT_DIR when it is set, so a cd into a subdirectory no longer hides or wrongly blocks an edit.

Fixed

• The situation rules shared by every prompt artifact no longer contradict themselves. A request outside the artifact's purpose declines and names what fits instead, partial or informal material is worked from with its gaps recorded, and only an absent required input stops the work. A refused embedded instruction is recorded on its own line instead of being reported as a finding.
• Full static reviews found and resolved contradictions or gaps in dozens of prompt artifacts: finding thresholds that excluded defects the same brief defines, steps a supported branch cannot follow, unsafe completion rules, and output instructions that disagreed with the output contract. Every prompt artifact, commands included, now states one checkable output contract, and check:contracts rejects a missing one or one that names an instruction section.
• 139 behavioral cases now contain the code, logs, plan, or data they refer to, so a reply can be judged on the evidence.
• Generated contexts state forbidding rules as prohibitions and summary rules as "When the task calls for it", and they install where Cursor and GitHub Copilot read them (.cursor/rules/, .github/instructions/) instead of doubled paths.
• commit-guard and prompt-secret-guard share one list of 117 credential formats with the repository scan. Before, they had 7 rules and let GitHub fine-grained tokens, npm, GitLab, and Google API keys, and PGP private keys through. commit-guard also refuses credential stores (.git-credentials, .netrc, cloud CLI credentials) and inspects content staged by the same command, aliases, git commit -nm, and core.hooksPath overrides.
• protected-branch-guard refuses git filter-branch, git filter-repo, and git fast-import; follows branch switches inside one command; resolves a bare git push through @{push}; and fails closed when Git cannot be read. Before, an alias, a push mapping, or a timeout could move main.
• shell-command-guard blocks /bin/rm -rf /, a root among several rm operands, a force push after Git global options or with -f next to --force-with-lease, bash <(curl …), a download that the same command then runs, and git checkout -f. It no longer blocks text quoted inside an argument.
• The six operation guards recognize many more publish, delete, apply, and service commands (cloud storage, Kubernetes, Terraform, Pulumi, registries, cron, launchd, systemd), npm abbreviations such as npm publ, package runners such as npx npm@10 publish, and value-taking global options. Several hooks no longer stall on sudo -- until the runtime timeout, which let the command run.
• release-clean-state-guard and release-version-consistency-guard gate mobile store uploads (fastlane, eas submit, xcrun altool, Gradle publish*) and check Xcode, Gradle, and Expo version sources. npm publish --access public and npm run build && npm publish no longer block.
• The system path, user account, firewall, container privilege, and archive extraction guards recognize many more mutating commands and name the rule they apply instead of "cannot be normalized".
• sensitive-file-access-guard blocks recursive searches, archives, and copies that include a protected file, and more reading tools; outbound-data-guard reads grouped curl options. Unquoted globs are expanded as bash does instead of blocking, so wc -l src/*.js passes.
• database-query-mode-guard treats SELECT … INTO as a write and reads every client call; migration-safety-guard covers more drop and reset forms and no longer blocks the TRUNCATE(x, d) function; schema-compatibility-guard handles reserved Protobuf fields, Avro defaults, and integer to number widening.
• ci-reference-pinning-guard and submodule-target-guard check the absolute paths Claude Code sends; before, they never fired there. Several hooks now run when invoked through a symlink instead of exiting without checking. mcp-capability-drift-guard refuses unknown servers and tools in any letter case, recognizes plugin-scoped tools, and uses Cursor's real MCP event.
• Smaller hook fixes: transport-security-regression-guard, unsafe-deserialization-guard, test-integrity-guard, debug-artifact-guard, lint-suppression-guard, api-contract-compatibility-guard, policy-file-guard, binary-mutation-guard, generated-file-guard, phase-gate-guard, tool-output-budget-guard, completion-evidence-guard, instruction-config-integrity-guard, and a prompt-secret-guard false positive on sk- words. The Italian and Dutch texts of four hooks no longer change the meaning of the English source.
• A Codex project-scope hook resolves its script from the Git root instead of the installing machine's absolute path, which pointed nowhere in a clone.
• The read-only MCP runtime no longer runs programs chosen by repository configuration (core.fsmonitor, gpg.program, filter drivers), refuses credential files at any depth, and negotiates the protocol version instead of echoing it.
• Installer: add --json and add-pack --json print JSON, options accept --name=value, --dry-run lists...