# Changelog

All notable changes to this project will be documented in this file.

## [v2.6.2] - 2026-10-14

### Fixed
- ignore __proto__ in frontmatter (#506) by @Haxxyyyy in [#506](https://github.com/rolecraft-sh/rolecraft/pull/506)
- sanitize untrusted terminal output (#503) by @Haxxyyyy in [#503](https://github.com/rolecraft-sh/rolecraft/pull/503)
- retry scorecard on cancelled outcomes (#507) by @Haxxyyyy in [#507](https://github.com/rolecraft-sh/rolecraft/pull/507)
- bound and verify npm tarball downloads (#502 #504 #505) by @Haxxyyyy in [#510](https://github.com/rolecraft-sh/rolecraft/pull/510)
- restrict profile and backup file permissions (#501) by @Haxxyyyy in [#501](https://github.com/rolecraft-sh/rolecraft/pull/501)
- normalize before matching and close scanner evasion gaps by @sametcelikbicak in [#499](https://github.com/rolecraft-sh/rolecraft/pull/499)
- scan file names and frontmatter for agent-authority grants by @sametcelikbicak in [#497](https://github.com/rolecraft-sh/rolecraft/pull/497)
- scan upstream content in check so a flagged update is visible by @sametcelikbicak in [#496](https://github.com/rolecraft-sh/rolecraft/pull/496)
- bound every untrusted read and report an incomplete scan by @sametcelikbicak in [#495](https://github.com/rolecraft-sh/rolecraft/pull/495)
- reject link entries and fail closed when a tarball cannot be listed by @sametcelikbicak in [#494](https://github.com/rolecraft-sh/rolecraft/pull/494)
- write MCP config atomically under a lock with owner-only permissions by @sametcelikbicak in [#493](https://github.com/rolecraft-sh/rolecraft/pull/493)
- gate every MCP config key and drop execution-authority keys from profiles by @sametcelikbicak in [#492](https://github.com/rolecraft-sh/rolecraft/pull/492)
- never report a high-severity finding as safe by @sametcelikbicak in [#491](https://github.com/rolecraft-sh/rolecraft/pull/491)
- stop bundle from forcing skills past the security scan by @sametcelikbicak in [#490](https://github.com/rolecraft-sh/rolecraft/pull/490)
- flag warp, goose and openhands as sharing the agents skills dir by @sametcelikbicak in [#479](https://github.com/rolecraft-sh/rolecraft/pull/479)
- verify and promote 5 agents from batch 1 - kilo, kode, codeium, augment, codearts-agent by @sametcelikbicak in [#473](https://github.com/rolecraft-sh/rolecraft/pull/473)
- verify dexto and loaf agents, repair two dead docUrls by @sametcelikbicak in [#466](https://github.com/rolecraft-sh/rolecraft/pull/466)
- repair dead benchmark link breaking the docs build by @sametcelikbicak in [#465](https://github.com/rolecraft-sh/rolecraft/pull/465)
- track manifest-derived counts in docs and guard against drift by @sametcelikbicak in [#463](https://github.com/rolecraft-sh/rolecraft/pull/463)
- stop tests and benchmark writing fixtures to the repo lockfile by @sametcelikbicak in [#462](https://github.com/rolecraft-sh/rolecraft/pull/462)

### Changed
- cover installSkill reporting a failed target by @sametcelikbicak in [#513](https://github.com/rolecraft-sh/rolecraft/pull/513)
- pass cwd explicitly instead of reassigning process.cwd by @sametcelikbicak in [#500](https://github.com/rolecraft-sh/rolecraft/pull/500)
- load command modules on demand instead of at startup by @sametcelikbicak in [#464](https://github.com/rolecraft-sh/rolecraft/pull/464)
- bump actions/first-interaction from 3.0.0 to 3.1.0 in [#461](https://github.com/rolecraft-sh/rolecraft/pull/461)
- bump actions/upload-artifact from 4.4.3 to 7.0.1 in [#460](https://github.com/rolecraft-sh/rolecraft/pull/460)
- bump actions/checkout from 4.1.1 to 7.0.1 in [#459](https://github.com/rolecraft-sh/rolecraft/pull/459)
- bump @biomejs/biome in [#458](https://github.com/rolecraft-sh/rolecraft/pull/458)
- grant attestations write and make npm publish idempotent by @sametcelikbicak in [#457](https://github.com/rolecraft-sh/rolecraft/pull/457)
- update changelog and version for v2.6.1 by @sametcelikbicak in [#456](https://github.com/rolecraft-sh/rolecraft/pull/456)

### Documentation
- verify and promote agent paths (batch 6) by @sametcelikbicak in [#478](https://github.com/rolecraft-sh/rolecraft/pull/478)
- verify and promote agent paths (batch 5) by @sametcelikbicak in [#477](https://github.com/rolecraft-sh/rolecraft/pull/477)
- verify and promote agent paths (batch 4) by @sametcelikbicak in [#476](https://github.com/rolecraft-sh/rolecraft/pull/476)
- verify and promote agent paths (batch 3) by @sametcelikbicak in [#475](https://github.com/rolecraft-sh/rolecraft/pull/475)
- verify and promote agent paths (batch 2) by @sametcelikbicak in [#474](https://github.com/rolecraft-sh/rolecraft/pull/474)
## [v2.6.1] - 2026-10-08

### Fixed
- drop invalid ruleset trigger from scorecard workflow by @sametcelikbicak in [#453](https://github.com/rolecraft-sh/rolecraft/pull/453)
- download-and-execute rule misses process and command substitution by @sametcelikbicak in [#449](https://github.com/rolecraft-sh/rolecraft/pull/449)
- drop useless String.raw on FLAGS regex fragment by @sametcelikbicak in [#447](https://github.com/rolecraft-sh/rolecraft/pull/447)
- deploy sitemap and add canonical, og:image and robots.txt to docs by @sametcelikbicak in [#446](https://github.com/rolecraft-sh/rolecraft/pull/446)

### Changed
- pin remaining GitHub actions to commit SHAs by @sametcelikbicak in [#454](https://github.com/rolecraft-sh/rolecraft/pull/454)
- retrigger scorecard on ruleset changes and allow manual runs by @sametcelikbicak in [#452](https://github.com/rolecraft-sh/rolecraft/pull/452)
- scope workflow token permissions to job level and verify release tag by @sametcelikbicak in [#451](https://github.com/rolecraft-sh/rolecraft/pull/451)
- add OpenSSF Scorecard and GitHub build provenance attestation by @sametcelikbicak in [#450](https://github.com/rolecraft-sh/rolecraft/pull/450)
- update changelog and version for v2.6.0 by @sametcelikbicak in [#445](https://github.com/rolecraft-sh/rolecraft/pull/445)

### Documentation
- add OpenSSF Scorecard badge by @sametcelikbicak in [#455](https://github.com/rolecraft-sh/rolecraft/pull/455)
## [v2.6.0] - 2026-10-07

### Added
- add --json output to search by @sametcelikbicak in [#439](https://github.com/rolecraft-sh/rolecraft/pull/439)
- add grok, muse and posit; correct antigravity paths and verify zcode and pochi by @sametcelikbicak in [#430](https://github.com/rolecraft-sh/rolecraft/pull/430)

### Fixed
- mark pages deployments inactive before deleting them by @sametcelikbicak in [#444](https://github.com/rolecraft-sh/rolecraft/pull/444)
- refuse lockfile slugs that escape the skills directory by @sametcelikbicak in [#443](https://github.com/rolecraft-sh/rolecraft/pull/443)
- report a corrupt MCP lock as a ci finding instead of a crash by @sametcelikbicak in [#437](https://github.com/rolecraft-sh/rolecraft/pull/437)
- record project-scoped agent installs in the project lockfile by @sametcelikbicak in [#436](https://github.com/rolecraft-sh/rolecraft/pull/436)
- merge profile apply into config and ask on conflicts by @sametcelikbicak in [#435](https://github.com/rolecraft-sh/rolecraft/pull/435)
- align doctor checks with skill lock paths by @kkkhs in [#434](https://github.com/rolecraft-sh/rolecraft/pull/434)
- escape angle brackets in agent notes so the docs build by @sametcelikbicak in [#433](https://github.com/rolecraft-sh/rolecraft/pull/433)
- clone gh: MCP servers into ~/.agents/mcp instead of the OS temp dir by @sametcelikbicak in [#428](https://github.com/rolecraft-sh/rolecraft/pull/428)
- never report success when the CLI did nothing  by @sametcelikbicak in [#426](https://github.com/rolecraft-sh/rolecraft/pull/426)
- widen prompt-injection detection to common phrasings by @sametcelikbicak in [#424](https://github.com/rolecraft-sh/rolecraft/pull/424)
- verify content hashes in ci by @sametcelikbicak in [#423](https://github.com/rolecraft-sh/rolecraft/pull/423)
- derive install targets from the lockfile entry by @sametcelikbicak in [#422](https://github.com/rolecraft-sh/rolecraft/pull/422)
- hash and install skill files in subdirectories by @sametcelikbicak in [#421](https://github.com/rolecraft-sh/rolecraft/pull/421)
- honor --dry-run in mcp remove by @sametcelikbicak in [#420](https://github.com/rolecraft-sh/rolecraft/pull/420)
- raise unscanned_source for MCP sources the scanner never reads by @sametcelikbicak in [#419](https://github.com/rolecraft-sh/rolecraft/pull/419)
- refuse corrupt MCP config files by @kkkhs in [#417](https://github.com/rolecraft-sh/rolecraft/pull/417)
- resolve agent identity by flag or name when capturing a profile by @sametcelikbicak in [#416](https://github.com/rolecraft-sh/rolecraft/pull/416)
- scan setup mcp servers by @kkkhs in [#415](https://github.com/rolecraft-sh/rolecraft/pull/415)
- run the security scan gate on every path that installs a skill by @sametcelikbicak in [#412](https://github.com/rolecraft-sh/rolecraft/pull/412)
- refuse non-https, non-default-port and credentialed profile import URLs by @muraa-p in [#386](https://github.com/rolecraft-sh/rolecraft/pull/386)

### Changed
- make the setup command delegate to setupApi by @sametcelikbicak in [#442](https://github.com/rolecraft-sh/rolecraft/pull/442)
- move completion generators into the api layer by @sametcelikbicak in [#441](https://github.com/rolecraft-sh/rolecraft/pull/441)
- finish UserError migration in resolver, profile, compose, convert by @sametcelikbicak in [#440](https://github.com/rolecraft-sh/rolecraft/pull/440)
- make npm test run the same suite as CI by @sametcelikbicak in [#438](https://github.com/rolecraft-sh/rolecraft/pull/438)
- bump @vue/server-renderer and vue in [#432](https://github.com/rolecraft-sh/rolecraft/pull/432)
- bump source-map-js from 1.2.1 to 1.2.2 in [#431](https://github.com/rolecraft-sh/rolecraft/pull/431)
- derive flags, help and completions from one command spec by @sametcelikbicak in [#427](https://github.com/rolecraft-sh/rolecraft/pull/427)
- delegate convert command to convertApi by @samiullah-636 in [#411](https://github.com/rolecraft-sh/rolecraft/pull/411)
- move agent detection to shared utility by @nikhiljangid120 in [#399](https://github.com/rolecraft-sh/rolecraft/pull/399)
- check doc values before merge instead of repairing after by @sametcelikbicak in [#398](https://github.com/rolecraft-sh/rolecraft/pull/398)
- update changelog and version for v2.5.0 by @sametcelikbicak in [#396](https://github.com/rolecraft-sh/rolecraft/pull/396)

### Documentation
- correct security and reproducibility claims, document what the scan does not cover by @sametcelikbicak in [#413](https://github.com/rolecraft-sh/rolecraft/pull/413)
## [v2.5.0] - 2026-10-02

### Added
- move star CTA from bot welcome to doctor output by @sametcelikbicak in [#384](https://github.com/rolecraft-sh/rolecraft/pull/384)
- credit every changelog entry to its author by @sametcelikbicak in [#357](https://github.com/rolecraft-sh/rolecraft/pull/357)

### Fixed
- cover release-prep.sh with a fixture test and fix its portability bugs by @sametcelikbicak in [#395](https://github.com/rolecraft-sh/rolecraft/pull/395)
- prevent watch from syncing its own install output by @PandaHUN777 in [#381](https://github.com/rolecraft-sh/rolecraft/pull/381)
- download-and-execute rule catches curl -fsSL and skips | shasum by @Bdysj in [#374](https://github.com/rolecraft-sh/rolecraft/pull/374)
- make docs-sync open a PR instead of pushing to protected main by @sametcelikbicak in [#391](https://github.com/rolecraft-sh/rolecraft/pull/391)
- require review for unscanned npm MCP servers by @YIKUAIBANZI in [#379](https://github.com/rolecraft-sh/rolecraft/pull/379)
- stop generated doc values from conflicting on every merge by @sametcelikbicak in [#387](https://github.com/rolecraft-sh/rolecraft/pull/387)
- keep project CI skills in project scope by @PandaHUN777 in [#378](https://github.com/rolecraft-sh/rolecraft/pull/378)
- clarify lock rename contention by @PandaHUN777 in [#377](https://github.com/rolecraft-sh/rolecraft/pull/377)
- thread cwd through ci, install and watch installSkill calls by @biggdawg320 in [#380](https://github.com/rolecraft-sh/rolecraft/pull/380)
- reject corrupt lockfiles safely by @tnalbant in [#376](https://github.com/rolecraft-sh/rolecraft/pull/376)
- security-scan MCP servers before profile apply writes them by @Bdysj in [#368](https://github.com/rolecraft-sh/rolecraft/pull/368)
- validate lockfile slugs in verify and agents-xml by @HarshRajSinghania in [#371](https://github.com/rolecraft-sh/rolecraft/pull/371)
- resolve rollback targets by agent name as well as flag by @Bdysj in [#364](https://github.com/rolecraft-sh/rolecraft/pull/364)
- remove temp clone dir when git URL resolution fails by @Bdysj in [#363](https://github.com/rolecraft-sh/rolecraft/pull/363)
- make MCP lock updates atomic and stop them losing each other by @muraa-p in [#362](https://github.com/rolecraft-sh/rolecraft/pull/362)
- re-check the npm tarball host allow-list on every redirect hop by @muraa-p in [#361](https://github.com/rolecraft-sh/rolecraft/pull/361)
- skip lockfile writes in rollback dry-run by @Bdysj in [#358](https://github.com/rolecraft-sh/rolecraft/pull/358)
- validate npm tarball redirects by @Yurii201811 in [#356](https://github.com/rolecraft-sh/rolecraft/pull/356)
- scope slug collisions to target agents by @kocaemre in [#348](https://github.com/rolecraft-sh/rolecraft/pull/348)
- serialise lockfile read-modify-write to stop lost updates by @muraa-p in [#355](https://github.com/rolecraft-sh/rolecraft/pull/355)
- re-check the profile import host allow-list on every redirect by @muraa-p in [#351](https://github.com/rolecraft-sh/rolecraft/pull/351)
- write lock file atomically via temp file and rename by @muraa-p in [#349](https://github.com/rolecraft-sh/rolecraft/pull/349)
- normalize agents xml test path by @premiuslol in [#341](https://github.com/rolecraft-sh/rolecraft/pull/341)
- honor cwd in apiUpdate installations by @PandaHUN777 in [#338](https://github.com/rolecraft-sh/rolecraft/pull/338)
- prevent normalized slug collisions by @PandaHUN777 in [#340](https://github.com/rolecraft-sh/rolecraft/pull/340)
- use UserError for skill-not-found in remove and update APIs by @amandeavor in [#298](https://github.com/rolecraft-sh/rolecraft/pull/298)

### Changed
- regenerate docs and manifest matrix by @sametcelikbicak in [#394](https://github.com/rolecraft-sh/rolecraft/pull/394)
- regenerate docs and manifest matrix by @sametcelikbicak in [#393](https://github.com/rolecraft-sh/rolecraft/pull/393)
- raise minimum supported Node to 22 and test 24 and 26 by @sametcelikbicak in [#383](https://github.com/rolecraft-sh/rolecraft/pull/383)
- cover convertApi dry-run for .mdc files by @chanchalagarwal3580 in [#372](https://github.com/rolecraft-sh/rolecraft/pull/372)
- point biome.json at the locked Biome version by @sametcelikbicak in [#373](https://github.com/rolecraft-sh/rolecraft/pull/373)
- run test matrix on macos-latest by @miteshanshu in [#365](https://github.com/rolecraft-sh/rolecraft/pull/365)
- cover global scope of assertNoSlugCollision by @miteshanshu in [#360](https://github.com/rolecraft-sh/rolecraft/pull/360)
- add unit tests for init and use APIs by @PandaHUN777 in [#359](https://github.com/rolecraft-sh/rolecraft/pull/359)
- add unit tests for api mcp, profile, ci and upgrade by @readyagentsdev in [#320](https://github.com/rolecraft-sh/rolecraft/pull/320)
- group npm dependabot updates by @premiuslol in [#321](https://github.com/rolecraft-sh/rolecraft/pull/321)
- test on Node 20, 22, and 24 by @PandaHUN777 in [#319](https://github.com/rolecraft-sh/rolecraft/pull/319)
- add unit tests for api setup, convert, agents-xml and completions by @vatsalyrai in [#318](https://github.com/rolecraft-sh/rolecraft/pull/318)
- make upgrade command reuse upgrade api by @premiuslol in [#315](https://github.com/rolecraft-sh/rolecraft/pull/315)
- bump @biomejs/biome from 2.5.5 to 2.5.14 in [#314](https://github.com/rolecraft-sh/rolecraft/pull/314)
- make init command reuse initApi by @vatsalyrai in [#313](https://github.com/rolecraft-sh/rolecraft/pull/313)
- add npm dependabot updates by @premiuslol in [#312](https://github.com/rolecraft-sh/rolecraft/pull/312)
- use watch close on SIGINT by @premiuslol in [#311](https://github.com/rolecraft-sh/rolecraft/pull/311)
- bump codeql-action to 4.38.2 and group its dependabot updates by @sametcelikbicak in [#303](https://github.com/rolecraft-sh/rolecraft/pull/303)
- reuse agents xml API in command by @vansh-nagar in [#300](https://github.com/rolecraft-sh/rolecraft/pull/300)
- cover update search verify and doctor APIs by @vansh-nagar in [#299](https://github.com/rolecraft-sh/rolecraft/pull/299)
- make watch command reuse the watch API by @vatsalyrai in [#290](https://github.com/rolecraft-sh/rolecraft/pull/290)
- bump codeql-action init and analyze to 4.38.0 by @sametcelikbicak in [#289](https://github.com/rolecraft-sh/rolecraft/pull/289)
- update changelog and version for v2.4.2 by @sametcelikbicak in [#286](https://github.com/rolecraft-sh/rolecraft/pull/286)

### Documentation
- explain convert API dry-run and destination resolution by @chanchalagarwal3580 in [#389](https://github.com/rolecraft-sh/rolecraft/pull/389)
## [v2.4.2] - 2026-09-17

### Fixed
- update manifest matrix line number for reference.md (#283)
- doctor Turkish text bug, add CI coverage, add E2E tests (#274)
- track all published agent counts (#273)

### Changed
- backfill supportLevel for 60 unclassified agents (#285)
- remove unreachable converted=[] dead branch in convertApi (#284)
- deduplicate shared utils and remove dead code (#281)
- share bundle loading and installation (#280)
- bump actions/deploy-pages from 5.0.0 to 5.0.1 (#279)
- bump actions/upload-artifact from 4 to 7 (#278)
- bump github/codeql-action/init from 4.37.8 to 4.37.9 (#277)
- bump github/codeql-action/analyze from 4.37.8 to 4.37.9 (#276)
- update changelog and version for v2.4.1 (#272)

### Documentation
- slim down README, move testimonials to CONTRIBUTING, add FAQ page (#275)

### Other
- cleanup: remove registry/publish, replace skills source, update demos (#282)
## [v2.4.1] - 2026-09-01

### Added
- colorize rolecraft help output (#271)
- add skipped and errored counters to check command summary (#270)
- reactivate manifest token matrix for docs (#264)

### Fixed
- remove skills from recorded agent directories (#259)

### Changed
- merge agent manifest registry (#269)
- replace fixed timeouts with log polling in watch command test (#268)
- bump github/codeql-action/init from 4.37.7 to 4.37.8 (#267)
- bump github/codeql-action/analyze from 4.37.7 to 4.37.8 (#266)
- bump actions/first-interaction from 1 to 3 (#265)
- derive completion agent flags (#262)
- extract shared security score helper (#263)
- welcome first-time contributors with soft star note (#261)
- cover MCP lockfile utilities (#258)
- update changelog and version for v2.4.0 (#257)

### Documentation
- use GitHub-whitelisted align attributes in contributors table
- center contributor avatars vertically and reduce to 80px
- add linhaixin45-cmyk testimonial with larger avatar layout (#260)
## [v2.4.0] - 2026-08-24

### Added
- add oh-my-pi (omp) agent support (#251)
- add contributor testimonials to README (#246)
- support multiple --skill flags and add skill name to security reports (#245)
- prune old pages deployments in docs workflow (#244)
- add agents and rollback shell completions (#242)
- reposition as security-first skill manager (#241)
- colorize succeed and fail markers (#226)
- add GitHub Release creation to publish workflow (#228)
- tabular CLI output with shared zero-dep tui module (#224)

### Changed
- bump github/codeql-action to 4.37.7 (#250)
- centralize tilde expansion (#249)
- extract scanner depth and lockfile version constants (#227)
- share slug normalization (#163)
- update changelog and version for v2.3.2 (#223)

### Documentation
- fix 18 audit issues across docs, README, and CLI help (#231)
- replace contributor table with auto-updating image (#230)
- add Lukakatche to contributors list (#225)
## [v2.3.2] - 2026-08-17

### Fixed
- repair npm README images and tighten package contents (#222)

### Changed
- update changelog and version for v2.3.1 (#221)
## [v2.3.1] - 2026-08-17

### Added
- complete P3 polish — npm allowlist, docs accuracy, sitemap+OG (#220)
- verify 10 more agent skill directories (26 verified total) (#219)

### Fixed
- guard against slug path traversal and harden security scans (#218)

### Changed
- cover converter utilities (#216)
- bump github/codeql-action/init from 4.37.3 to 4.37.6 (#215)
- bump github/codeql-action/analyze from 4.37.3 to 4.37.6 (#214)
- extract home helper to shared utility (#210)
- update changelog and version for v2.3.0 (#212)

### Documentation
- add alloutflo to contributors list (#217)
- add devmaster1987 to contributors list (#213)
## [v2.3.0] - 2026-08-06

### Added
- add apps.json for wvw.dev listing (#201)

### Fixed
- warn MCP servers execute arbitrary code for non-github sources (#211)
- handle rejected debounce callbacks
- security scan bypass in setup/profile/ci + bundle + P1 hardening (#202)

### Changed
- cover shared debounce utility
- add shared debounce utility
- use shared watch debouncer
- share watch debounce logic
- restore console stubs and add progress bar fail coverage
- add unit tests for src/utils/spinner.js
- update changelog and version for v2.2.0 (#200)

### Documentation
- add Kegorapetse to contributors (#209)
- add Caner Bektaş to contributors list
## [v2.2.0] - 2026-07-31

### Added
- filter installed skills by agent (#158)
- update demo GIFs with corrected timing and fix init dispatch (#197)
- add template system to rolecraft init (--template, --list) (#196)
- add rollback mechanism, parallel install, error handling improvements (#195)

### Fixed
- silence init stdout to avoid node:test desync (#199)
- add rollback --help suggestion and showError integration test
- remove redundant deploy-docs job from release-publish (docs.yml auto-deploys on push)

### Changed
- round 2 — fix remaining architectural issues (#194)
- fix top 5 architectural issues (#193)
- update changelog and version for v2.1.0 (#192)

### Documentation
- add adity982 to contributors
- update landing page for new features (#198)
- add RoleCraft branding to skills README
- update README positioning, tagline, and npm description
- update stale values — 87.4 kB, 86 agents
## [v2.1.0] - 2026-07-28

### Added
- auto-generate benchmark SVG from results data (#191)
- replace hardcoded claims with manifest tokens, update benchmark with current data (#190)
- add agents capability manifest command and generated agent docs (#186)
- add API modules for CLI-only commands and Node.js API cross-references (#183)
- update publish message for auto-merge workflow (#182)
- add category to publish flow; fix YAML quote stripping

### Fixed
- use full URL for SVG in RESULTS.md to fix VitePress build
- close watchers and debounce timers deterministically in watch tests (#189)
- update public claims — agent count and package size from manifest, soften absolute language (#188)
- publish directly to upstream registry, fall back to fork on 403
- remove check-updates from completions, add -d descriptions and -o/-s y flags to fish
- complete missing commands and flags
- add checkout step in deploy-docs job for gh workflow run

### Changed
- bump postcss from 8.5.16 to 8.5.23 (#187)
- update repo references from sametcelikbicak to rolecraft-sh in docs and examples
- update changelog and version for v2.0.1 (#179)

### Documentation
- update comparison.md with garden-skills and fix duplicate row
- add MFA-G to contributors list
- fix auto-merge references to reflect maintainer merge workflow
## [v2.0.1] - 2026-07-24

### Fixed
- use upstream commit SHA for branch creation, add error bodies, document gh auth token

### Changed
- bump version to 2.0.1 (registry publish fix + npm pack hygiene)
- bump github/codeql-action/analyze from 4.37.1 to 4.37.3 (#178)
- bump github/codeql-action/init from 4.37.1 to 4.37.3 (#177)
- release v2.0.0

### Documentation
- update publish success message to reflect maintainer review
- add marketplace badge to CI guide
- add Marketplace badge to CI section, fix agent count, add registry source link
- complete v2.0.0 docs audit (api diff/compose/test, comparison, CHANGELOG dup fix)
## [v2.0.0] - 2026-07-24

### Added
- add GitHub Registry MVP — search, publish, install by slug, version check, API exports (#172)
- progress bar, TUI flicker/resize fix, CLI help update (#170)
- add doctor --deep conflict detection (#169)
- add rolecraft diff and compose commands (#168)
- add rolecraft test command with assertion engine (#164)
- add Node.js API layer with src/api/ modules (#159)
- add rolecraft mcp check command for npm update checks
- add MCP config validation to rolecraft doctor (P2)
- add MCP security scan for gh: and npm: sources (P2)
- add version pinning for npm (@version) and gh (@branch/@tag) MCP sources (P1)
- add rolecraft mcp search command for GitHub and npm (P1) (#18)
- add MCP lockfile for ci restore (P0) (#151)
- add uvx:, pipx:, go:, deno:, cargo: MCP source types (#149)
- enhance doctor command with comprehensive health checks (#147)
- add multi-skill support to use and setup commands (#146)
- multi-skill install with interactive selection, --list, and --skill flags (#145)

### Fixed
- readme table formatting and move mgalore to new row
- reject empty convert sources (#171)
- execSync→spawnSync for CodeQL alert, fix doc build (unclosed array<string> tag), add publish/registry to sidebar and nav (#173)
- resolve CodeQL alerts 88 and 89 (#166)
- resolve CodeQL alerts in test command (#165)
- remove unused imports flagged by CodeQL (#82, #83) (#162)
- remove unused imports flagged by CodeQL (#160)
- validate MCP agent support — only 7 of 86+ agents have MCP (#150)
- remove unused report function in doctor.js (CodeQL #73)

### Changed
- replace string concat with template literals
- add Biome lint/format with pre-commit hook and fix CodeQL alerts
- trigger CodeQL re-analysis
- exclude test files and dev artifacts from npm bundle
- bump actions/checkout from 7.0.0 to 7.0.1 (#148)
- update repo references from sametcelikbicak to rolecraft-sh
- release v1.6.0

### Documentation
- add mgalore to contributors (#175)
- fix badge logo visibility with logoColor=white
- collapse nav to 3 items with dropdowns for small screens
- update AGENTS.md with interaction rules and branch strategy
- add mcp update/check docs, add mcp to shell completions
- add GitHub Action badge, CI guide, and docs page

### Other
- Update paths
## [v1.6.0] - 2026-07-20

### Added
- add --json flag to list command (#120)
- add git and npm availability checks
- add skills.sh search with --skills-sh flag (experimental) (#101)
- add convert command for SKILL.md <-> .mdc format conversion (#100)
- add droid, chatgpt, codearts-agent, universal agents (86 total)

### Fixed
- log reinstall failure in watch command
- document install yes flag in help
- resolve CodeQL alerts and flaky ENOTEMPTY tests
- enable docs deployment after release

### Changed
- bump version to v1.6.0
- bump github/codeql-action/analyze from 4.37.0 to 4.37.1 (#115)
- bump github/codeql-action/init from 4.37.0 to 4.37.1
- bump actions/setup-node from 6.4.0 to 7.0.0
- add star CTA to README (#102)
- update changelog and version for v1.5.0 [skip ci] (#97)

### Documentation
- add Benjamin Ayivoh to contributors, convert to grid layout
- add star request to CONTRIBUTING.md
- add Gaohar Imran and Ajay Krishnan to contributors table
- add Yurii201811 to contributors table
- add getting-started, use-cases, and CLI reference pages (#103)
- streamline README for Show HN launch

## [v1.5.0] - 2026-07-15

### Added
- improve UX with dry-run consistency, spinner, and error formatting (#96)
- agent profile system (save, apply, diff, edit, export, import, link) (#89)
- add demo GIF to hero section and show version in site title (#88)
- add benchmark comparison SVG visual with color contrast fixes (#87)

### Fixed
- use full URL for benchmark SVG to prevent VitePress build failure

### Changed
- bump actions/upload-pages-artifact from 3.0.1 to 5.0.0 (#86)
- bump actions/configure-pages from 5.0.0 to 6.0.0 (#85)
- bump actions/deploy-pages from 4.0.5 to 5.0.0 (#84)
- bump github/codeql-action/init from 4.36.3 to 4.37.0 (#83)
- bump github/codeql-action/analyze from 4.36.3 to 4.37.0 (#82)
- update changelog and version for v1.4.0 [skip ci] (#81)

### Documentation
- simplify CONTRIBUTING, move release process to RELEASE.md, add good first issues
- onboarding guide + profile guide + fix dry-run priority and flag ordering (#90)
- update architecture.md with missing commands and utils
- add profile command to sidebar and fix formatting
## [v1.4.0] - 2026-07-10

### Added
- improve README, add GitHub templates, fix CodeQL alert, resolve Dependabot CVEs, 100% watch.js coverage (#74)
- add watch command for auto-syncing skills on file change
- add benchmark to docs site, remove ANALYSIS from sidebar (#72)
- add VitePress docs site with GitHub Pages deploy (#71)
- highlight MCP + Skills as key differentiator in README
- MCP server management for AI agents

### Fixed
- use real user identity for tag signing in release-prep workflow
- use web streams pipeTo for downloadFile to resolve CodeQL http-to-file-access (#79)
- use web streams pipeTo for downloadFile to resolve CodeQL http-to-file-access
- resolve CodeQL alerts — http-to-file-access and log-injection (#78)
- close security vulnerabilities and add watch to comparison (#75)

### Changed
- async/sync cleanup, process.exit removal, magic string dedup (#77)
- centralize agent list into src/agents.js and extend MCP to all 82 agents
- update changelog and version for v1.3.0 [skip ci] (#68)

### Documentation
- deduplicate nav links and add benchmark reference

### Other
- Revert "fix: use web streams pipeTo for downloadFile to resolve CodeQL http-to-file-access"
## [v1.3.0] - 2026-07-07

### Added
- add agents-xml command for AGENTS.md XML generation (#63)
- add 16 new agent targets, surpass Vercel (82 vs 72 agents) (#61)
- add rolecraft doctor command for system health checks (#60)
- add security scoring for installed skills (0-100 static analysis) (#57)
- add npm package source support (npm:package) (#53)

### Fixed
- add missing return after process.exit in frozenLockfile, update, and remove blocks (#66)
- stop after blocked installs (#62)
- support SSH signing in release-prep workflow + update docs (#59)
- preserve GPG signature when release-prep moves tag to changelog commit (#58)
- remove unused mkdirSync import (CodeQL #42) + AGENTS.md merge rule
- use mkdtempSync for npm temp dir (CodeQL insecure-temporary-file)
- resolve CodeQL audit findings and improve test hygiene

### Changed
- release v1.2.0

### Documentation
- improve repo quality - code of conduct, support, benchmark, migration guide (#67)
- reorganize Contributing and Contributors sections in README
- add contributors section to README (#65)
## [v1.2.0] - 2026-07-06

### Added
- add SKILL.md for skills.sh leaderboard visibility (#50)
- add --yes flag, check command, GitLab/SSH URL support, and 20 new agents

### Fixed
- remaining 5 code scanning alerts (unused vars, file-system-race)
- resolve remaining CodeQL alerts
- allow workflow_dispatch in publish job condition
- add workflow_dispatch to release-publish workflow (#43)

### Changed
- improve coverage to 95% - add missing tests, fix coverage config (#46)
- upgrade Node to 24, migrate CodeQL to v4, fix code scanning alerts
- update changelog and version for v1.1.0 [skip ci] (#42)

### Documentation
- add startup checklist to AGENTS.md (#51)
- update AGENTS.md workflow instructions
- add AGENTS.md with development guidelines
## [v1.1.0] - 2026-07-03

### Added
- security hardening - provenance, CodeQL, Dependabot, action pinning, npm audit (#36)
- add rolecraft upgrade self-update command (#35)
- add 13 new agent targets (43 total), update analysis and docs (#34)
- shell completions + interactive TUI search (#32)
- improve repo visibility with demo GIF, badges, and enhanced metadata (#31)

### Fixed
- rolecraft install --help shows help instead of installing; --copy clears previous symlinks (#41)
- copilot path now uses .github/copilot/skills/ + docs update

### Changed
- bump github/codeql-action/init
- bump actions/setup-node from 5.0.0 to 6.4.0
- bump actions/checkout from 5.0.1 to 7.0.0 (#37)
- bump github/codeql-action/analyze
- update changelog and version for v1.0.0 [skip ci] (#30)

### Documentation
- add Product Hunt badge, Node version badge
## [v1.0.0] - 2026-06-27

### Added

- add bundle command with inline sources and bundle create (#26)
- add interactive search mode (--interactive) (#25)
- add --dry-run mode for install and setup commands (#24)
- add 9 new agent targets (roo, trae, hermes, kiro, augment, kilo, openhands, junie, factory) (#23)
- add verify, ci, content hash, symlink mode (#22)
- add init, search, 20 agent targets, frozen-lockfile (#21)

### Changed

- update changelog and version for v0.2.0 [skip ci] (#19)

### Documentation

- restructure README into modular documentation hub (#28)
- update ANALYSIS.md and README.md with accurate competitive data (#27)
- remove test coverage metrics from analysis and update roadmap

### Other

- Bug fixes and improvements for stable release (#29)
- add devin (Devin Desktop) agent target with windsurf backward compat (#20)

## [v0.2.0] - 2026-06-25

### Added

- make project scope default install target
- add rolecraft setup command to detect agents and install
- add rolecraft use command to preview skills without installing
- add windsurf, codex, copilot, aider, cline agent targets

### Changed

- enable npm provenance and add SECURITY.md
- add coverage improvements for install, update, resolver (#13)
- release v0.1.4

### Documentation

- add competitive analysis and roadmap

## [v0.1.4] - 2026-06-25

### Added

- cursor target, update command, project-scoped remove, and more (#11)

### Changed

- release v0.1.3

### Documentation

- add contributing guide and CODEOWNERS (#10)

## [v0.1.3] - 2026-06-21

### Fixed

- remove unnecessary npm install step

### Changed

- release v0.1.2

## [v0.1.2] - 2026-06-20

### Added

- add changelog automation with GitHub Actions
- add version command (version, --version, -v) (#4)

### Fixed

- use pull_request_target and npm install for release-publish
- use echo -e instead of printf for newlines; skip merge commits in changelog
- delete existing branch before creating new one
- restructure release-prep workflow YAML and use PAT_TOKEN
- resolve YAML syntax error in release-prep workflow and fix script for Linux compatibility
- list command now includes project-scoped skills (#3)

### Changed

- release v0.1.1

### Other

- Update README

## [v0.1.1] - 2026-06-20

### Added

- add changelog automation with GitHub Actions
- add version command (version, --version, -v) (#4)

### Fixed

- use echo -e instead of printf for newlines; skip merge commits in changelog
- delete existing branch before creating new one
- restructure release-prep workflow YAML and use PAT_TOKEN
- resolve YAML syntax error in release-prep workflow and fix script for Linux compatibility
- list command now includes project-scoped skills (#3)

### Other

- Update README

## [v0.1.0] - 2026-06-14

### Added

- Initial release with core CLI functionality
- Version command (`version`, `--version`, `-v`)
- List command with project-scoped skills support
- Zero-dependency CLI for opencode, claude-code, cursor, and more