chore: sync private v5.4.0 (65d20e0)

[agent-kit-startup]

Summary

• Automated allowlist sync from the private source of truth.
• Release v5.4.0.
• Head branch sync/v5.4.0-65d20e0.

Release notes

Changed

• CI no longer runs the entire build twice per pull-request push. push: branches ["**"] overlapped pull_request completely; pushes now trigger on main, staging and v* tags, where there is no PR to cover them. Superseded PR runs are cancelled by a concurrency group; main, staging and tag runs always finish. Both properties are pinned by tests.
• CI builds before its guard steps. test:root-node includes the session-start hook diagnostic, which asserts the hook resolves the CLI through packages/cli/dist instead of reporting degraded mode; with Build ordered last, that suite could only pass on a machine that had already built. A pin test now holds the order.
• Ten root test suites that no command ran are now in test:root-node, which CI executes: the plan-external-review atomic-wait / backend-cascade / model-routing suites, comms-draft, check-guidance-stale-claims, validate-memory-index, hook-session-start-diagnostic, orchestration-defects-regression, sync-landing and sync-public-guards. 46 root tests become 87. The two guards that had tests but no runner - check:guidance-claims and check:memory-index - are npm scripts now and run inside CI's Evidence checks.
• docs/DEVELOPMENT.md gains a repository-layout table for the root artifacts that read as leftovers but are not: cursor-handoff, the install contracts, the registry authoring docs, skills-registry.json, HANDOFF.md.example, autogit/, _legacy/, dogfood/. Each is path-stable for a reason (public-sync manifest entries, raw-URL install links, inbound references), which is why they stay at the root.
• dashboard/README.md documents the Mission Control runtime layout and, explicitly, why its tests live in packages/cli/src/dashboard/ - the CLI package owns the workspace's only test runner and imports the .mjs files directly, so there is one implementation under test rather than a copy.
• docs/evidence/README.md states, per artifact, which generator produces it, whether it reproduces off the generating machine, and whether CI enforces it. evidence:file-ledger:check is documented as a local replay tool rather than a gate - its census covers the working tree, stashes and ignored-operational files, so it cannot pass on another checkout - and its failure message now says so instead of reading like a stale artifact.
• New check:markdown-links guard (scripts/check-markdown-links.mjs, wired into test:root-node, so CI's Evidence checks enforce it): every relative markdown link in the tracked surface must resolve, with template placeholders ({plan-slug}) explicitly excluded. 234 files scanned.
• pnpm lint now covers the half of the repository Biome never saw: dashboard/**, scripts/** and .cursor/scripts/** are checked before turbo run lint fans out to the workspace packages. Previously the only lint task in the graph was packages/cli's biome check src, so 56 root-level files - including the Mission Control runtime and the evidence generators - were exempt from the same gate that CI and /git-staging present as repo-wide.

Fixed

• landing:vendor reports the real failure. The React/ReactDOM download had no status check and no timeout, so a CDN 404 or 500 was hashed as if it were the library and surfaced as a confusing "SRI mismatch"; a hung connection had no bound at all. It now fails with the HTTP status and aborts after 30s.
• sync-public no longer shells out to sleep(1) between poll attempts - a POSIX-only dependency in the publication path. The synchronous wait uses Atomics.wait on a zeroed buffer instead.
• De-flake the dashboard auth-exemption test. Its readiness loop slept only when fetch threw, so a non-ready status spun the event loop the spawned serve.mjs needed to finish booting, and an accepted-but-unanswered connection could consume the entire budget because no attempt was bounded. Each attempt now carries a 2s AbortSignal.timeout, every iteration is spaced, an early child exit fails immediately with its stderr instead of waiting for the test timeout, and the budget is 20s inside a 60s test.
• agent-kit contribute carries a skill's companion files upstream. buildRegistryPathMap mapped only SKILL.md, and the path guess accepted only paths ending in /SKILL.md, so a consumer that added a checklist or a references/ file to a skill contributed the entry point and silently dropped the rest. Both now treat a skill as the directory it is; the legacy flat layout still maps to community.
• Skill companion files reach the consumer. agent-kit add, pack install, L0 sync and agent-kit diff enumerated SKILL.md and nothing else, so a skill that ships a checklist or a references/ folder arrived with dead links in every installed tree. Install and diff now share one skillFileTargets() enumerator (recursive, SKILL.md first, hidden files skipped, and a missing directory still yields the old single pair), so the whole skill lands.
• Derived guidance no longer pins a superseded release. .cursor/project-context.md recorded product version 5.2.1 and lane SHAs frozen at 2026-07-31 while the tree shipped 5.3.0; comms surfaces (docs/comms*.md, the mission-kit-comms skill and agent), docs/cursor-update-awareness.md and install.md restated 5.0.0 / 5.2.x as the current release. Where the number was load-bearing it is now dated and paired with the surface to read it from (CHANGELOG.md, npm dist-tags, .cursor-plugin/plugin.json); docs/npm-publish-checklist.md drops its 5.0.0-era "today" snapshots for the commands that answer the question at run time.
• Dead relative links across the tracked markdown surface: .cursor/agents/** pointed at .cursor/rules/*.mdc, autogit/gitupdate.md and README.md as if it were reading from the repository root, docs/capability-inventory.md prefixed its own siblings with docs/, and autogit/plan-routine.md did the same. References to private trees (.cursor/memory/**) are now inline paths rather than links, since those paths never reach the public sync. .cursor/skills/community/n8n-workflows/ regained the checklist-n8n.md its SKILL.md links to.
• Clear the 16 Biome violations that scope gap had been hiding: formatting in dashboard/lib/triage-heading.mjs, scripts/validate-memory-index*.mjs, scripts/git-hooks-pre-commit-composed.test.mjs, .cursor/scripts/comms-draft.mjs and .cursor/scripts/plan-external-review-progress-gate.test.mjs; resolveSnapshotRepoRoot no longer declares a defaulted parameter before a required one (the undefined env still falls back to process.env, matching guards.d.mts); indexLinkTargets uses matchAll instead of an assignment-in-condition loop; the session-start hook diagnostic builds its env by destructuring instead of delete.

Source

• Commit: 65d20e0
• Head branch: sync/v5.4.0-65d20e0

[Copilot]

Pull request overview

Automated sync for the v5.4.0 release, updating the CLI/kit versions, expanding CI + root-level guard coverage, and fixing skill install/diff/contribute behavior so companion files (not only SKILL.md) are included across consumer workflows.

Changes:

• Ensure skill installs/diffs/contributions enumerate and copy all skill companion files (recursive, hidden files skipped), with new test coverage for install + contribute path mapping.
• Refine CI triggers/concurrency and reorder steps so build artifacts exist before guard suites; expand root node --test coverage and add markdown link checking.
• Update release/version metadata and documentation to reflect the new release and clarified source-of-truth guidance.

Reviewed changes

Copilot reviewed 40 out of 40 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/build-registry.mjs	Import ordering tweak (format/lint consistency).
packages/cli/src/registry/install.ts	Add skillFileTargets() / skillTargetDir() and install skill companion files for single skills and packs.
packages/cli/src/registry/install-skill-files.test.ts	New tests covering skill file enumeration + install behavior (including nested companions).
packages/cli/src/lifecycle/overlay-known-hashes.ts	Add newly shipped overlay hashes.
packages/cli/src/lifecycle/diff.ts	Include companion skill files when diffing against registry (packs + direct skills).
packages/cli/src/lifecycle/contribute.ts	Map and guess registry paths for companion skill files (packs + direct skills + legacy layout).
packages/cli/src/lifecycle/contribute-skill-files.test.ts	New tests validating contribute path mapping for companion skill files and legacy layout.
packages/cli/src/dashboard/guards.test.ts	De-flake readiness loop with bounded fetch attempts, spacing, and early-exit diagnostics.
packages/cli/src/dashboard/ci-private-origin-allowlist.test.ts	Add CI behavior pin tests for triggers/build ordering.
packages/cli/package.json	Bump CLI package version to 5.4.0.
package.json	Bump repo version to 5.4.0; expand root scripts (checks + broader lint + root node tests).
install.md	Update manifest example version (now needs to track 5.4.0).
docs/npm-publish-checklist.md	Replace hardcoded “today” versions with runtime checks / commands.
docs/DEVELOPMENT.md	Document root-level artifact layout, dashboard test location rationale, and evidence artifact expectations.
docs/cursor-update-awareness.md	Update version guidance to reference .cursor-plugin/plugin.json with dated context.
docs/comms.md	Update comms guidance to reference shipped surfaces rather than hardcoded versions.
docs/comms-content-calendar.md	Align claim checks/version guidance with “read from shipped surfaces” approach.
docs/comms-channel-map.md	Align “claims match shipped docs” language with current release approach.
docs/capability-inventory.md	Fix relative doc links (needs one remaining malformed link corrected).
docs/agentkit-landing.md	Replace private-tree link with inline private path reference.
dashboard/README.md	New runtime layout README and test-location rationale.
dashboard/lib/triage-heading.mjs	Formatting-only change.
dashboard/lib/guards.mjs	Fix parameter default ordering; clarify JSDoc typing and process.env fallback behavior.
CHANGELOG.md	Add 5.4.0 release entry and update some references to private-path style.
autogit/plan-routine.md	Fix relative links to .cursor rules/docs and to gitupdate.md.
.github/workflows/ci.yml	Narrow push triggers, add concurrency cancellation for PRs, reorder build before guard steps, add guard runners.
.cursor/skills/community/n8n-workflows/checklist-n8n.md	Add missing companion checklist file for the skill.
.cursor/skills/community/mission-kit-comms/SKILL.md	Update version-floor wording to reference newest closed changelog version with date.
.cursor/skills/community/clickup/SKILL.md	Fix rule reference to be a path (not a broken relative link).
.cursor/scripts/plan-external-review-progress-gate.test.mjs	Formatting-only change.
.cursor/scripts/comms-draft.mjs	Formatting-only changes; keep publish refusal message single-line.
.cursor/agents/sql-schema.md	Fix relative link to rules directory.
.cursor/agents/prompts-agents.md	Fix relative link to rules directory.
.cursor/agents/n8n-workflows.md	Fix relative links to rules directory.
.cursor/agents/mission-kit-comms.md	Update “claims must match shipped” language.
.cursor/agents/git-autogit.md	Fix relative links to autogit docs and rules directory.
.cursor/agents/docs-repo.md	Fix relative link to repo README.
.cursor/agents/clickup-tasks.md	Fix relative links to rules/skills and autogit docs.
.cursor/agent-kit.json	Bump manifest version to 5.4.0.
.cursor-plugin/plugin.json	Bump plugin version to 5.4.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.