Merge branch 'main' into update-contributors

.github/plugin/marketplace.json

@@ -51,7 +51,7 @@
     {
       "name": "ai-ready",
       "description": "Analyze any repository and generate AI-ready configuration — AGENTS.md, copilot-instructions.md, CI workflows, issue templates, and more. Mines your PR review patterns and creates files customized to your stack.",
-      "version": "1.1.0",
+      "version": "1.3.0",
       "author": {
         "name": "John Papa",
         "url": "https://github.com/johnpapa"
@@ -72,7 +72,7 @@
         "source": "github",
         "repo": "johnpapa/ai-ready",
         "path": ".github/plugin",
-        "ref": "v1.1.0"
+        "ref": "v1.3.0"
       }
     },
     {
@@ -979,7 +979,7 @@
     {
       "name": "keep-the-why",
       "description": "Preserves or recovers the reasoning behind a codebase — architectural decisions, rejected alternatives, workarounds, incident learnings, operational constraints, and historical context the code itself cannot explain.",
-      "version": "0.10.1",
+      "version": "0.12.0",
       "author": {
         "name": "Oliver Zehentleitner",
         "url": "https://github.com/oliver-zehentleitner"
@@ -998,7 +998,7 @@
       "source": {
         "source": "github",
         "repo": "oliver-zehentleitner/keep-the-why",
-        "ref": "v0.10.1"
+        "ref": "v0.12.0"
       }
     },
     {
@@ -1809,7 +1809,7 @@
     {
       "name": "upgrade-agent",
       "description": "AI-powered upgrade assistant for upgrading and migrating applications. Helps modernize legacy code and upgrade .NET applications to current frameworks.",
-      "version": "1.1.441",
+      "version": "1.1.485",
       "author": {
         "name": "Microsoft",
         "url": "https://www.microsoft.com"
@@ -1828,8 +1828,8 @@
         "source": "github",
         "repo": "microsoft/upgrade-agent-plugins",
         "path": "plugins/upgrade-agent",
-        "ref": "v1.1.441",
-        "sha": "f8abab778cfb5b57a3c745d540631b7aab15d5b3"
+        "ref": "v1.1.485",
+        "sha": "de2dd654a288726652de81998fbaff7a849891dc"
       }
     },
     {

README.md

@@ -547,6 +547,8 @@ Thanks goes to these wonderful people ([emoji key](./CONTRIBUTING.md#contributor
       <td align="center" valign="top" width="14.28%"><a href="https://www.cloudblogger.eu"><img src="https://avatars.githubusercontent.com/u/53148138?v=4" width="100px;" alt=""/><br /><sub><b>Konstantinos Passadis | Azure MVP | MCT</b></sub></a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/alx-so"><img src="https://avatars.githubusercontent.com/u/8975621?v=4" width="100px;" alt=""/><br /><sub><b>Alex Sokol</b></sub></a></td>
       <td align="center" valign="top" width="14.28%"><a href="http://blogs.gnome.org/jmatsuzawa/"><img src="https://avatars.githubusercontent.com/u/545426?v=4" width="100px;" alt=""/><br /><sub><b>Jiro Matsuzawa</b></sub></a></td>
+    </tr>
+    <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/GuoCheng24"><img src="https://avatars.githubusercontent.com/u/224264187?v=4" width="100px;" alt=""/><br /><sub><b>Guo Cheng</b></sub></a></td>
     </tr>
   </tbody>

eng/yaml-parser.mjs

@@ -168,8 +168,14 @@ function parseSkillMetadata(skillPath) {
         entries.forEach((entry) => {
           const filePath = path.join(dirPath, entry.name);
           if (entry.isDirectory()) {
+            if (entry.name === "bin" || entry.name === "obj") {
+              return; // Skip bin and obj directories as they are .NET project output folders and not part of the skill assets
+            }
             arrayOfFiles = getAllFiles(filePath, arrayOfFiles);
-          } else if (!entry.isSymbolicLink() || !skipsAsBundledAsset(filePath)) {
+          } else if (
+            !entry.isSymbolicLink() ||
+            !skipsAsBundledAsset(filePath)
+          ) {
             const relativePath = path.relative(skillPath, filePath);
             if (relativePath !== "SKILL.md") {
               // Normalize path separators to forward slashes for cross-platform consistency
@@ -245,7 +251,10 @@ function parseHookMetadata(hookPath) {
           const filePath = path.join(dirPath, entry.name);
           if (entry.isDirectory()) {
             arrayOfFiles = getAllFiles(filePath, arrayOfFiles);
-          } else if (!entry.isSymbolicLink() || !skipsAsBundledAsset(filePath)) {
+          } else if (
+            !entry.isSymbolicLink() ||
+            !skipsAsBundledAsset(filePath)
+          ) {
             const relativePath = path.relative(hookPath, filePath);
             if (relativePath !== "README.md") {
               // Normalize path separators to forward slashes for cross-platform consistency
@@ -337,8 +346,8 @@ export {
   extractMcpServerConfigs,
   extractMcpServers,
   parseFrontmatter,
-  parseSkillMetadata,
   parseHookMetadata,
+  parseSkillMetadata,
   parseWorkflowMetadata,
   parseYamlFile,
   safeFileOperation,

package-lock.json

@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "license": "MIT",
       "dependencies": {
-        "js-yaml": "^5.2.3",
+        "js-yaml": "^5.4.1",
         "vfile": "^6.0.3",
         "vfile-matter": "^5.0.1"
       },
@@ -885,9 +885,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
       "funding": [
         {
@@ -1010,9 +1010,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
-      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
+      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
       "funding": [
         {
           "type": "github",

package.json

@@ -45,7 +45,7 @@
     "all-contributors-cli": "^6.26.1"
   },
   "dependencies": {
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.4.1",
     "vfile": "^6.0.3",
     "vfile-matter": "^5.0.1"
   },

plugins/external.json

@@ -29,7 +29,7 @@
   {
     "name": "ai-ready",
     "description": "Analyze any repository and generate AI-ready configuration — AGENTS.md, copilot-instructions.md, CI workflows, issue templates, and more. Mines your PR review patterns and creates files customized to your stack.",
-    "version": "1.1.0",
+    "version": "1.3.0",
     "author": {
       "name": "John Papa",
       "url": "https://github.com/johnpapa"
@@ -50,7 +50,7 @@
       "source": "github",
       "repo": "johnpapa/ai-ready",
       "path": ".github/plugin",
-      "ref": "v1.1.0"
+      "ref": "v1.3.0"
     }
   },
   {
@@ -687,7 +687,7 @@
   {
     "name": "keep-the-why",
     "description": "Preserves or recovers the reasoning behind a codebase — architectural decisions, rejected alternatives, workarounds, incident learnings, operational constraints, and historical context the code itself cannot explain.",
-    "version": "0.10.1",
+    "version": "0.12.0",
     "author": {
       "name": "Oliver Zehentleitner",
       "url": "https://github.com/oliver-zehentleitner"
@@ -706,7 +706,7 @@
     "source": {
       "source": "github",
       "repo": "oliver-zehentleitner/keep-the-why",
-      "ref": "v0.10.1"
+      "ref": "v0.12.0"
     }
   },
   {
@@ -1229,7 +1229,7 @@
   {
     "name": "upgrade-agent",
     "description": "AI-powered upgrade assistant for upgrading and migrating applications. Helps modernize legacy code and upgrade .NET applications to current frameworks.",
-    "version": "1.1.441",
+    "version": "1.1.485",
     "author": {
       "name": "Microsoft",
       "url": "https://www.microsoft.com"
@@ -1248,8 +1248,8 @@
       "source": "github",
       "repo": "microsoft/upgrade-agent-plugins",
       "path": "plugins/upgrade-agent",
-      "ref": "v1.1.441",
-      "sha": "f8abab778cfb5b57a3c745d540631b7aab15d5b3"
+      "ref": "v1.1.485",
+      "sha": "de2dd654a288726652de81998fbaff7a849891dc"
     }
   },
   {

skills/ai-team-orchestration/references/anti-patterns.md

@@ -11,3 +11,22 @@
 | Bugs and decisions kept only in chat | Use the repository's issue tracker and durable context | Future sessions can discover them. |
 | QA fixes application source | QA reports behavior; Dev implements fixes | Separation preserves independent verification. |
 | Treating every automated suggestion as a requirement | Assess relevance, confidence, scope, and practical risk | Review should improve the product, not expand scope without limit. |
+
+## Role responsibilities (Do / Don't)
+
+- Producer
+  - Do: Clarify outcome, constraints, acceptance criteria, and explicit exclusions; coordinate reviewers and merge policy.
+  - Don't: Implement or ship code changes that should be reviewed by Dev.
+
+- Dev
+  - Do: Implement the smallest complete solution, run listed verification, include tests, and prepare the PR with verification steps.
+  - Don't: Merge without required checks, failing tests, or without documenting risks and decisions.
+
+- QA (optional)
+  - Do: Independently verify behavior, file reproducible issues, and confirm fixes after Dev applies them.
+  - Don't: Modify application source as a shortcut for failing verification — report and hand back to Dev.
+
+## Decision logging guidance
+
+- Record material decisions in a DECISIONS.md or the repository issue tracker with: title, date, owner, decision summary (1 line), rationale, and link to related PR/issue.
+- Keep entries short and searchable; record the next action when a decision defers work.

skills/ai-team-orchestration/references/brainstorm-format.md

@@ -87,3 +87,20 @@ Each agent reviews from their perspective:
 
 Flag issues and suggest fixes.
 ```
+
+## Sample agent prompts (minimal)
+
+- Producer (short):
+```
+You are Remy, the Producer. Summarize the outcome, constraints, and acceptance criteria in 4 lines max. List required reviewers and whether QA is needed. End with the single next action.
+```
+
+- Dev (short):
+```
+You are Nova+Sage (Dev). Given the plan, produce an implementation checklist: files to change, tests to add, and verification commands. Keep it actionable.
+```
+
+- QA (short):
+```
+You are Ivy (QA). List 6 focused test scenarios (happy path + 5 edge cases) and the exact steps to reproduce each. Include expected results.
+```

skills/ai-team-orchestration/references/project-brief-template.md

@@ -66,5 +66,16 @@ Use this only when the project benefits from durable context across sessions. Ke
 - Dev: implementation and verification
 - QA: optional independent behavioral verification
 
+## Onboarding checklist (add to brief)
+
+- Setup verified: `npm ci` / `pip -r requirements.txt`
+- Tests run: `npm test` / `pytest -q`
+- Lint pass: `npm run lint`
+- Where to find CI logs and deploy dashboards
+
+## Where to record decisions
+
+- Add short entries to DECISIONS.md or create an issue with the decision tag. Each entry should include: title, date, owner, 1-line summary, rationale, and link to PR/issue.
+
 Record material decisions, blockers, and the next action here or in the active plan. Use GitHub Issues or the repository's tracker for bugs and follow-up work.
 ```

skills/ai-team-orchestration/references/sprint-plan-template.md

@@ -32,20 +32,41 @@ Use this for substantial work. Small, clear changes can proceed directly from th
 ## Acceptance Criteria
 
 - [ ] [observable behavior]
-- [ ] Relevant repository checks pass
+- [ ] Relevant repository checks pass (example: `npm run lint`, `npm test`)
+- [ ] Tests covering the change are added or validated
 - [ ] Documentation/context is updated when behavior or operation changed
 
 ## Verification
 
 - Automated: [commands or checks]
+  - Example: `npm ci && npm run test` or `pytest -q`
+  - Example: `npm run lint && npm run build`
 - Manual: [focused scenarios, if useful]
 - Independent review: required / optional / not needed - [reason]
 - QA: required / optional / not needed - [reason]
 
+## PR Checklist (add to PR body)
+
+- Branch name follows repo policy (e.g., `feat/`, `fix/`, or `chore/`)
+- Description: short summary, why, and acceptance criteria
+- Verification steps included (commands & manual checks)
+- Tests added or existing tests updated
+- Relevant docs/PROJECT_BRIEF updated if behavior changed
+- Reviewers: @team or specific owners
+- Required checks: list CI jobs that must pass
+- Release notes / changelog entry: yes/no
+
 ## Risks and Decisions
 
 - [risk or material decision]
 
+## QA risk matrix (when to require QA)
+
+- High impact × High uncertainty = QA required
+- High impact × Low uncertainty = QA recommended
+- Low impact × High uncertainty = QA recommended
+- Low impact × Low uncertainty = QA optional
+
 ## Next Action
 
 [owner and immediate next step]

skills/flowstudio-power-automate-build/SKILL.md

@@ -411,50 +411,43 @@ print(f"Status: {result['responseStatus']}, via: {result['invocation']}")
 print(result.get("warning"))   # set when a required input was missing: the run still ran, with null
 ```
 
-### Brand-new non-HTTP flows (Recurrence, connector triggers, etc.)
+### Brand-new non-HTTP flows
 
-A brand-new Recurrence or connector-triggered flow has **no prior runs** to
-resubmit and no HTTP endpoint to call. This is the ONLY scenario where you
-need the temporary HTTP trigger approach below. **Deploy with a temporary
-HTTP trigger first, test the actions, then swap to the production trigger.**
+A brand-new **Recurrence** flow needs no workaround: deploy it, then run it
+immediately with `trigger_live_flow` and no `body` — same as the portal's
+"Run flow" button. A body is refused; scheduled triggers take no inputs.
 
-Compact recipe:
+A brand-new **connector-triggered** flow (SharePoint, webhooks) has no prior
+runs and cannot fire without a real source event. Deploy with a temporary
+HTTP trigger, test the actions, then swap to the production trigger:
 
 ```python
 production_trigger = definition["triggers"]
 definition["triggers"] = {
     "manual": {"type": "Request", "kind": "Http", "inputs": {"schema": {}}}
 }
-
-result = mcp("update_live_flow",
-    environmentName=ENV,
+result = mcp("update_live_flow", environmentName=ENV,
     flowName=FLOW_ID,       # omit if creating new
-    definition=definition,
-    connectionReferences=connection_references,
+    definition=definition, connectionReferences=connection_references,
     displayName="Overdue Invoice Notifications")
-FLOW_ID = FLOW_ID or result["created"]
+FLOW_ID = FLOW_ID or result["flowName"]
 
-test = mcp("trigger_live_flow", environmentName=ENV, flowName=FLOW_ID,
+mcp("trigger_live_flow", environmentName=ENV, flowName=FLOW_ID,
     body={"sample": "payload"})
 runs = mcp("get_live_flow_runs", environmentName=ENV, flowName=FLOW_ID, top=1)
-
 if runs[0]["status"] == "Failed":
     err = mcp("get_live_flow_run_error",
         environmentName=ENV, flowName=FLOW_ID, runName=runs[0]["name"])
     raise Exception(err["failedActions"][-1])
 
 definition["triggers"] = production_trigger
-mcp("update_live_flow",
-    environmentName=ENV,
-    flowName=FLOW_ID,
-    definition=definition,
-    connectionReferences=connection_references)
+mcp("update_live_flow", environmentName=ENV, flowName=FLOW_ID,
+    definition=definition, connectionReferences=connection_references)
 ```
 
 The trigger is only the entry point; testing through HTTP still exercises the
 same actions. If actions use `triggerBody()` or `triggerOutputs()`, pass a
-representative `trigger_live_flow.body` shaped like the production trigger
-payload.
+representative `body` shaped like the production trigger payload.
 
 ---
 

skills/flowstudio-power-automate-debug/SKILL.md

@@ -409,10 +409,10 @@ print(new_runs[0]["status"])   # Succeeded = done
 | Scenario | Use | Why |
 |---|---|---|
 | **Testing a fix** on any flow | `resubmit_live_flow_run` | Replays the exact trigger payload that caused the failure — best way to verify |
-| Recurrence / scheduled flow | `resubmit_live_flow_run` | Cannot be triggered on demand any other way |
+| Recurrence / scheduled flow | `trigger_live_flow` (no `body`) | Runs it now, like the portal's "Run flow" button; resubmit replays a past run's data |
 | SharePoint / connector trigger | `resubmit_live_flow_run` | Cannot be triggered without creating a real SP item |
 | HTTP, Button, or PowerApps trigger with **custom** test payload | `trigger_live_flow` | When you need to send different data than the original run |
-| Brand-new flow, never run | `trigger_live_flow` (HTTP, Button, PowerApps) | No prior run exists to resubmit |
+| Brand-new flow, never run | `trigger_live_flow` | No prior run exists to resubmit |
 
 ### Testing HTTP, Button, and PowerApps flows with custom payloads
 
@@ -445,8 +445,10 @@ if result.get("warning"):
 ```
 
 > `trigger_live_flow` handles AAD-authenticated triggers automatically.
-> Works for `Request` triggers only: HTTP request, Button, and PowerApps.
-> Scheduled and connector triggers cannot be run this way.
+> Works for `Request` triggers (HTTP request, Button, PowerApps) and for
+> scheduled (Recurrence) flows, which it runs immediately — with no `body`,
+> since a scheduled trigger takes no inputs (a body is refused). Automated
+> connector triggers only fire from their source event.
 >
 > Power Automate does not enforce a trigger's `required` inputs. If you leave
 > one out the run still starts, with that input null, and the result carries a

skills/flowstudio-power-automate-mcp/SKILL.md

@@ -26,6 +26,9 @@ skills that all build on this one.
 > compatible Power Automate MCP server). You will need:
 > - MCP endpoint: `https://mcp.flowstudio.app/mcp` (same for all subscribers)
 > - API key / JWT token (`x-api-key` header — NOT Bearer)
+> - In ChatGPT or claude.ai there is no key: add `https://mcp.flowstudio.app/mcp/oauth`
+>   as a connector and sign in with Microsoft — see the
+>   [ChatGPT walkthrough](https://learn.flowstudio.app/chatgpt-power-automate)
 > - Power Platform environment name (e.g. `Default-<tenant-guid>`)
 
 ---

skills/flowstudio-power-automate-mcp/references/tool-reference.md

@@ -93,9 +93,9 @@ Response: wrapper object with `connections` array.
 > Filter by status: prefer `overallStatus == "Connected"` when present; otherwise
 > check `statuses[0].status == "Connected"`.
 >
-> For build workflows, pass `environmentName` to avoid using a connection from
-> the wrong environment. Omit it only when intentionally inventorying connections
-> across all environments.
+> `environmentName` is required — the platform cannot list connections across
+> environments (omitting it answers 400 MissingEnvironmentFilter). Get one from
+> `list_live_environments`.
 >
 > Pass `search=<connector or account>` to narrow output and receive
 > `connectionReferenceTemplate` plus `hostTemplate` values that can be copied
@@ -448,9 +448,10 @@ Response keys: `flowKey`, `triggerName`, `triggerKind`, `invocation`, `triggerUr
 `requiresAadAuth`, `authType`, `responseStatus`, `responseBody`, `runName`, and
 `warning` when a required trigger input was not supplied.
 
-> **Works for `Request` triggers: HTTP request, Button, and PowerApps.** Returns an
-> error for Recurrence and connector triggers:
-> `"only HTTP Request triggers can be invoked via this tool"`.
+> **Works for `Request` triggers (HTTP request, Button, PowerApps) and for
+> scheduled (Recurrence) flows.** A scheduled flow runs immediately, like the
+> portal's "Run flow" button, and takes no `body` — one is refused. Automated
+> connector triggers only fire from their source event and return an error.
 >
 > HTTP triggers go through the signed callback URL (`invocation: callbackUrl`).
 > Button and PowerApps triggers have no callback URL; with a `body` they run
@@ -483,8 +484,7 @@ Response keys: `flowKey`, `triggerName`, `triggerKind`, `invocation`, `triggerUr
 
 ### `set_live_flow_state`
 
-Start or stop a Power Automate flow via the live PA API. Does **not** require
-a Power Clarity workspace — works for any flow the impersonated account can access.
+Start or stop a Power Automate flow in any environment you have access to.
 Reads the current state first and only issues the start/stop call if a change is
 actually needed.
 
@@ -594,11 +594,11 @@ tool schemas cannot tell you.
   connectionReferences. Use `set_live_flow_state` to start/stop a flow.
 
 ### `trigger_live_flow`
-- **Works for HTTP, Button, and PowerApps triggers.** Returns error for Recurrence,
-  connector, and other trigger types.
+- **Works for HTTP, Button, PowerApps, and scheduled (Recurrence) triggers.**
+  A scheduled flow runs with no `body`. Automated connector triggers error.
 - Pass trigger inputs as `body`. A `warning` in the result means a required input
   was missing and the run started with it null.
-- AAD-authenticated triggers are handled automatically (impersonated Bearer token).
+- AAD-authenticated triggers are handled automatically (Bearer token attached).
 
 ### `get_live_flow_runs`
 - `top` defaults to **30** with automatic pagination for higher values.
@@ -611,8 +611,9 @@ tool schemas cannot tell you.
 - `poster`: `"Flow bot"` for Workflows bot identity, `"User"` for user identity.
 
 ### `list_live_connections`
-- For build workflows, pass `environmentName`; omitting it inventories
-  connections across environments.
+- `environmentName` is required; the platform cannot list connections across
+  environments. `top` is applied after `search` and the result carries
+  `truncated` + `matchedCount` when the cap drops matches.
 - Use `search=<connector/account>` to get smaller output and paste-ready
   `connectionReferenceTemplate` / `hostTemplate` values.
 - `id` is the value you need for `connectionName` in `connectionReferences`.