agestra - npm Package Compare versions

Comparing version 4.14.1 to 4.14.2

AGENTS.md

+# Agestra for Codex
+
+This repository includes a Codex-friendly host wrapper for Agestra.
+
+## First Run
+
+1. Build the bundled MCP server if needed: `npm run bundle`
+2. Register this checkout with Codex and install user-scope generated custom agents/skills: `npm run install:codex`
+3. For a real npm-global install from this checkout instead, run `npm run bundle`, `npm install -g .`, then `npm run install:codex:global`
+4. Open the target repository in Codex. Its `AGENTS.md` file is loaded automatically when the project is trusted.
+
+Use `npm run install:codex:mcp` only when you intentionally want MCP registration without generated Codex agents/skills. Use `npm run install:codex:assets` only when you intentionally want project-local `.codex/agents` and `.codex/skills` assets in the current checkout.
+Low-level MCP calls do not silently write setup. High-level Agestra workflows must call `setup_status` first; if it reports `Setup required: yes`, run the interactive setup questions immediately, call `setup_apply` after the user chooses providers/locale, then resume the original workflow.
+Use `host_assets_status` to inspect generated Codex host assets, and only call `host_assets_install` after the user agrees to install or refresh Codex custom agents. The `host_assets_*` MCP tools currently manage Codex assets only.
+
+## How to Work Here
+
+- Default to direct Codex work using the workspace `AGENTS.md` contract, oh-my-codex workflows, and Superpowers-style skills when they apply.
+- Use Agestra primarily for explicit multi-AI or provider orchestration requests, such as when the user names Agestra, Codex/Gemini/Ollama providers, "multi-AI", "multiple AI", "provider", `agent_debate_*`, `cli_worker_*`, or asks to gather/compare several AI opinions.
+- Plain review/QA/check requests without `/agestra` or explicit multi-AI/provider wording stay with the current host; they are not Agestra natural-language auto-triggers.
+- Agestra natural-language routing requires explicit multi-AI/provider wording such as "multiple AIs", "all AIs", "other AI", "multi-AI", "Codex and Gemini", "provider comparison", or "프로바이더 비교". Explicit `/agestra ...` commands remain supported.
+- Native helper agents are created by the active host layer. In Codex, use the generated custom agents installed from these assets; external MCP/CLI/chat providers participate through Agestra tools and never create or manage Codex native agents.
+- Keep Agestra setup/status/provider checks as installation and health checks, not as workflow-routing triggers.
+- Run `setup_status`, `environment_check`, and `provider_list` when the task concerns Agestra installation, MCP registration, host assets, provider availability, or before entering an Agestra workflow. If `setup_status` reports `Setup required: yes`, complete interactive setup first and then resume the original task.
+- Do not treat ordinary review, QA, security, design, idea, implementation, cleanup, build-fix, or planning requests as Agestra workflows just because setup/status/provider checks exist.
+- When an Agestra workflow is active, treat `commands/*.md` as the source of truth for that workflow.
+- Prefer Agestra MCP tools over ad-hoc multi-provider prompting only when the task is actually in Agestra/multi-provider mode.
+- If any legacy workflow text mentions old single-host Agestra execution, treat it as obsolete. Direct current-host work should happen outside Agestra workflows.
+
+## Workflow Mapping
+
+- When Agestra is active, review requests follow `commands/review.md`
+- When Agestra is active, QA / verification requests follow `commands/qa.md`
+- When Agestra is active, security audit requests follow `commands/security.md`
+- Review, QA, and security workflows write durable reports under `docs/reports/review/`, `docs/reports/qa/`, and `docs/reports/security/` unless the user asks for chat-only output.
+- Persistent E2E test creation/maintenance is internal: QA produces `E2E_TEST_WORK_REQUEST`, the leader asks the user, and approved work goes to `agestra-implementer` with `mode: e2e-test-authoring`.
+- When Agestra is active, design and architecture requests follow `commands/design.md`
+- When Agestra is active, idea discovery requests follow `commands/idea.md`
+- When Agestra is active, implementation requests follow `commands/implement.md`
+
+## Core MCP Tools
+
+- `setup_status`, `environment_check`, and `provider_list`: inspect installation, host, and provider state for Agestra health checks and active Agestra workflows
+- `agent_consensus_start` (with `agent_debate_approve`/`_continue`/`_reject`) and `agent_debate_review`: run approval-gated consensus flows from prepared `initial_aggregation`
+- `cli_worker_spawn`, `agent_changes_review`, `agent_changes_accept`, `agent_changes_reject`: use for explicit autonomous Codex/Gemini worker tasks
+- `host_assets_status`, `host_assets_install`, `host_assets_uninstall`: inspect and explicitly manage generated Codex host-native assets such as custom agents and skills
+- `qa_run`: run workspace build/test verification before reporting implementation completion
+
+## Project Assets
+
+- `agents/`: canonical role prompts (`agestra-team-lead`, `agestra-research`, `agestra-debate`, `agestra-implementer`)
+- `skills/`: reusable workflow references
+- `GEMINI.md` and `.gemini/commands/`: Gemini-specific host assets; keep behavior aligned with them when updating shared workflows

.claude-plugin/marketplace.json

@@ -15,3 +15,3 @@ {
       "description": "Multi-host MCP orchestration across Claude, Ollama, Gemini, and Codex for review, QA, and cross-validation",
-      "version": "4.14.1",
+      "version": "4.14.2",
       "author": {
@@ -18,0 +18,0 @@ "name": "mua-vtuber"

.claude-plugin/plugin.json

 {
   "name": "agestra",
-  "version": "4.14.1",
+  "version": "4.14.2",
   "description": "Claude Code plugin — multi-host MCP orchestration across Claude, Ollama, Gemini, and Codex for review, QA, and cross-validation",
@@ -5,0 +5,0 @@ "mcpServers": {

package.json

 {
   "name": "agestra",
-  "version": "4.14.1",
+  "version": "4.14.2",
   "description": "Multi-host MCP orchestration for Claude Code, Codex CLI, Gemini CLI, and local models",
@@ -5,0 +5,0 @@ "type": "module",

README.ja.md

@@ -82,5 +82,3 @@ # Agestra
 
-- [docs/tool-inventory.md](docs/tool-inventory.md): MCP ツール一覧
 - [commands/](commands): ワークフロー仕様
-- [docs/plans/](docs/plans): 設計と実装の計画メモ
 
@@ -87,0 +85,0 @@ ## 開発

README.ko.md

@@ -82,5 +82,3 @@ # Agestra
 
-- [docs/tool-inventory.md](docs/tool-inventory.md): MCP 도구 목록
 - [commands/](commands): 워크플로우 기준 문서
-- [docs/plans/](docs/plans): 설계와 구현 관련 계획 문서
 
@@ -87,0 +85,0 @@ ## 개발

README.md

@@ -82,5 +82,3 @@ # Agestra
 
-- [docs/tool-inventory.md](docs/tool-inventory.md): MCP tool reference
 - [commands/](commands): workflow source of truth
-- [docs/plans/](docs/plans): design and implementation notes
 
@@ -87,0 +85,0 @@ ## Development

README.zh.md

@@ -82,5 +82,3 @@ # Agestra
 
-- [docs/tool-inventory.md](docs/tool-inventory.md): MCP 工具清单
 - [commands/](commands): 工作流规范
-- [docs/plans/](docs/plans): 设计与实现计划文档
 
@@ -87,0 +85,0 @@ ## 开发

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Minified code

Quality

This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1439464

7.92%

Number of package files

65

1.56%

Lines of code

5926

6.83%

Number of low quality alerts

0

-100%

Number of low supply chain risk alerts

4

-73.33%

Number of medium supply chain risk alerts

0

-100%

Worsened metrics

Number of lines in readme file

120

-1.64%

No dependency changes