ai-driven-dev · aidd-bot · Jul 19, 2026 · Jul 19, 2026 · Jul 16, 2026 · Jul 18, 2026
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
   "name": "aidd-framework",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Official plugin marketplace for the AI-Driven Development framework",
   "owner": {
     "name": "AI-Driven Dev"
@@ -31,7 +31,7 @@
     {
       "name": "aidd-pm",
       "source": "./plugins/aidd-pm",
-      "description": "Product management: ticket-info, user-stories, prd, spec",
+      "description": "Product management: ticket-info, user-stories, product-brief, prd, spec, spike",
       "strict": true,
       "recommended": true
     },

@@ -1,5 +1,5 @@
 # Default reviewers for every change in this repository.
 # GitHub assigns these reviewers automatically when a pull request is opened.
-# Only Habilité AIDD maintainers can approve and merge - see GOVERNANCE.md.
+# Only AIDD Maintainers can approve and merge - see GOVERNANCE.md.
 # See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-*       @ai-driven-dev/habilitated
+*       @ai-driven-dev/trusted-partners
@@ -6,9 +6,3 @@ contact_links:
   - name: Discord community
     url: https://discord.gg/EWySJSpjWs
     about: Ask questions, get help, or chat with the AI-Driven Dev community in real time.
-  - name: Website
-    url: https://www.ai-driven-dev.fr/
-    about: Read the AI-Driven Dev methodology, guides, and announcements.
-  - name: Report a security vulnerability
-    url: https://github.com/ai-driven-dev/framework/security/advisories/new
-    about: Disclose a vulnerability privately via GitHub Security Advisories. Do not open a public issue.
@@ -1,13 +1,13 @@
-name: 🗺️ Roadmap item
-description: "Maintainer-authored work: a skill, a refactor, a rule to enforce"
+name: 📋 Detailed Contribution
+description: "Propose a scoped change: a skill, a refactor, a rule to enforce"
 title: "<type>(<scope>): "
 type: Task
 body:
   - type: markdown
     attributes:
       value: |
-        For maintainers planning framework work. Reporting a bug or asking for a feature as a user?
-        Use the **Bug Report** or **Feature Request** form instead.
+        Issue-first: a maintainer validates this before any PR is opened (see [CONTRIBUTING.md](https://github.com/ai-driven-dev/framework/blob/main/CONTRIBUTING.md)).
+        Reporting a bug? Use the **Bug Report** form instead.
 
         The title carries its own scope, matching `commitlint.config.cjs`: `feat(aidd-pm):`, `fix(framework):`, `refactor(aidd-context):`.
   - type: textarea

@@ -1,14 +1,13 @@
-name: ✨ Feature Request
-description: Propose new content or an improvement to the framework
+name: 🌱 Quick Contribution
+description: Propose a change or new content for the framework, minimal form
 title: "feat(<scope>): "
 type: Feature
 body:
   - type: markdown
     attributes:
       value: |
-        Have an idea? You can also post and upvote it in
-        [Discussions](https://github.com/ai-driven-dev/framework/discussions) -
-        popular ideas get promoted to a roadmap vote (see [ROADMAP.md](https://github.com/ai-driven-dev/framework/blob/main/ROADMAP.md)).
+        Issue-first: a maintainer validates this before any PR is opened (see [CONTRIBUTING.md](https://github.com/ai-driven-dev/framework/blob/main/CONTRIBUTING.md)).
+        Want to discuss an idea first? Post it in [Discussions](https://github.com/ai-driven-dev/framework/discussions).
   - type: textarea
     id: problem
     attributes:

@@ -28,3 +28,16 @@ updates:
       include: "scope"
     labels:
       - "dependencies"
+
+  - package-ecosystem: "npm"
+    directory: "cli"
+    target-branch: "next"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
@@ -28,7 +28,7 @@ jobs:
           app-id: ${{ secrets.AIDD_BOT_APP_ID }}
           private-key: ${{ secrets.AIDD_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: next
           fetch-depth: 0
@@ -58,6 +58,10 @@ jobs:
             BRANCH="back-merge/main-to-next-${{ github.run_id }}"
             git checkout -b "$BRANCH" origin/main
             git push origin "$BRANCH"
+            # promote.yml matches this exact title prefix to recognize a
+            # squash-merged conflict resolution as a sync boundary (this repo
+            # disallows merge-commit PRs, so this can't land as a real merge
+            # commit). Keep both in sync if you change it.
             gh pr create --base next --head "$BRANCH" \
               --title "chore: back-merge main into next (conflicts)" \
               --body "Automated back-merge hit conflicts (CHANGELOG / manifest / version files). Resolve manually, then merge into next." \

@@ -12,6 +12,8 @@ concurrency:
 permissions:
   contents: write
   pull-requests: write
+  packages: write
+  id-token: write
 
 jobs:
   commitlint:
@@ -22,7 +24,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
@@ -110,7 +112,7 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build clean marketplace bundle
         # A self-contained marketplace a user can extract and register with
@@ -157,9 +159,9 @@ jobs:
           - { tool: codex, mode: flat, flag: "--flat" }
           - { tool: opencode, mode: flat, flag: "--flat" }
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
@@ -209,7 +211,7 @@ jobs:
             echo "released=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: steps.check.outputs.released == 'true'
 
       - name: Get plugin version
@@ -239,3 +241,46 @@ jobs:
           gh release upload "${TAG}" \
             "/tmp/${PLUGIN}-v${VERSION}.zip" \
             --clobber
+
+  publish-cli:
+    name: Publish cli
+    needs: [release-please]
+    if: needs.release-please.outputs.paths_released != '' && contains(fromJSON(needs.release-please.outputs.paths_released), 'cli')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm build
+
+      - name: Publish to GitHub Packages
+        continue-on-error: true
+        working-directory: cli
+        run: |
+          printf '%s\n%s\n' "@ai-driven-dev:registry=https://npm.pkg.github.com" "//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}" > .npmrc
+          pnpm publish --no-git-checks
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Real OIDC trusted publishing (npm CLI >= 11.5.1, Node >= 22.14.0), not a
+      # token — matches the npmjs.com trusted-publisher entry for
+      # ai-driven-dev/framework, workflow ci.yml. No NPM_TOKEN secret needed.
+      # `npm publish`, not `pnpm publish`: pnpm's OIDC support is unverified/
+      # buggy as of this writing (pnpm/pnpm#9812, #11513) — npm's own CLI is
+      # the reference implementation for its own feature.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+      - name: Publish to npm
+        working-directory: cli
+        run: |
+          rm -f .npmrc
+          npm install -g npm@latest
+          npm publish --access public
@@ -0,0 +1,115 @@
+name: cli CI
+
+# Native path-filtered isolation: this whole workflow is skipped when nothing
+# under cli/ changed — no third-party paths-filter action needed.
+
+on:
+  push:
+    branches: [main, next]
+    paths:
+      - "cli/**"
+  pull_request:
+    paths:
+      - "cli/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  cli-typecheck:
+    name: cli / Typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm typecheck
+
+  cli-lint:
+    name: cli / Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm lint
+
+  cli-test:
+    name: cli / Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install expect (TTY persona tests)
+        run: sudo apt-get update && sudo apt-get install -y expect
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm test
+
+  cli-build:
+    name: cli / Build & Bundle Budget
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm build
+
+  cli-knip:
+    name: cli / Knip (dead code)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm knip:production
+
+  cli-jscpd:
+    name: cli / JSCPD (duplication)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@latest --activate
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+      - run: cd cli && pnpm install --frozen-lockfile
+      - run: cd cli && pnpm jscpd
@@ -28,18 +28,18 @@ jobs:
         language: [javascript-typescript]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
         with:
           category: "/language:${{ matrix.language }}"
@@ -30,7 +30,7 @@ jobs:
           app-id: ${{ secrets.AIDD_BOT_APP_ID }}
           private-key: ${{ secrets.AIDD_BOT_PRIVATE_KEY }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
@@ -50,14 +50,42 @@ jobs:
           BRANCH="promote/next-to-main-linear"
           git switch -C "$BRANCH" origin/main
 
-          mapfile -t MERGES < <(git rev-list --first-parent --merges --reverse origin/main..origin/next)
-          if [ "${#MERGES[@]}" -ge 2 ]; then
-            START="${MERGES[$((${#MERGES[@]} - 2))]}"
+          # A "sync commit" marks a point where main's history was already
+          # folded into next by back-merge.yml, so it (and everything before
+          # it) must NOT be replayed onto main again. back-merge.yml lands a
+          # sync two ways:
+          #   - no conflicts: a direct-pushed real merge commit (2 parents)
+          #   - conflicts: a PR merged by squash (this repo disallows
+          #     merge-commit PRs), whose subject is stamped verbatim from
+          #     back-merge.yml's fixed PR title
+          # Both must count as boundaries, or a squash sync gets mistaken for
+          # genuine next-only work and cherry-picked back onto main, colliding
+          # with content main already has. Keep the title prefix below in
+          # sync with back-merge.yml's `gh pr create --title`.
+          is_sync_commit() {
+            git rev-parse --verify -q "$1^2" >/dev/null 2>&1 && return 0
+            local subject
+            subject="$(git log -1 --format=%s "$1")"
+            [[ "$subject" == "chore: back-merge main into next"* ]]
+          }
+
+          mapfile -t CANDIDATES < <(git rev-list --first-parent --reverse origin/main..origin/next)
+          SYNCS=()
+          for c in "${CANDIDATES[@]}"; do
+            is_sync_commit "$c" && SYNCS+=("$c")
+          done
+
+          if [ "${#SYNCS[@]}" -ge 2 ]; then
+            START="${SYNCS[$((${#SYNCS[@]} - 2))]}"
           else
             START="origin/main"
           fi
 
-          mapfile -t COMMITS < <(git rev-list --first-parent --reverse --no-merges "${START}..origin/next")
+          COMMITS=()
+          while IFS= read -r c; do
+            is_sync_commit "$c" || COMMITS+=("$c")
+          done < <(git rev-list --first-parent --reverse "${START}..origin/next")
+
           if [ "${#COMMITS[@]}" -eq 0 ]; then
             echo "No commits to promote."
             exit 0