Merge pull request #115 from cyberfabric/up-sdlc-and-bugfixes

fix(kit): register new manifest resources in core.toml during kit update

Author: ainetx

.agents/skills/cypilot/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cypilot
-description: "Invoke when user asks to do something with Cypilot, or wants to analyze/validate artifacts, or create/generate/implement anything using Cypilot workflows, or plan phased execution. Core capabilities: workflow routing (plan/analyze/generate/auto-config); deterministic validation (structure, cross-refs, traceability, TOC); code↔artifact traceability with @cpt-* markers; spec coverage measurement; ID search/navigation; init/bootstrap; adapter + registry discovery; auto-configuration of brownfield projects (scan conventions, generate rules); kit management (install/update with file-level diff); TOC generation; agent integrations (Windsurf, Cursor, Claude, Copilot, OpenAI). Kit sdlc: Artifacts: ADR, CODEBASE, DECOMPOSITION, DESIGN, FEATURE, PR-CODE-REVIEW-TEMPLATE, PR-REVIEW, PR-STATUS-REPORT-TEMPLATE, PRD; Workflows: pr-review, pr-status."
+description: "Invoke when user asks to do something with Cypilot, or wants to analyze/validate artifacts, or create/generate/implement anything using Cypilot workflows, or plan phased execution. Core capabilities: workflow routing (plan/analyze/generate/auto-config); deterministic validation (structure, cross-refs, traceability, TOC); code↔artifact traceability with @cpt-* markers; spec coverage measurement; ID search/navigation; init/bootstrap; adapter + registry discovery; auto-configuration of brownfield projects (scan conventions, generate rules); kit management (install/update with file-level diff); TOC generation; agent integrations (Windsurf, Cursor, Claude, Copilot, OpenAI). Kit sdlc: Artifacts: ADR, CODEBASE, DECOMPOSITION, DESIGN, FEATURE, PR-CODE-REVIEW-TEMPLATE, PR-REVIEW, PR-STATUS-REPORT-TEMPLATE, PRD; Workflows: migrate-openspec, pr-review, pr-status."
 ---
 
 

.bootstrap/.core/skills/cypilot/scripts/cypilot/__init__.py

@@ -17,7 +17,7 @@ def main(argv: Optional[List[str]] = None) -> int:
     from .cli import main as _main
     return _main(argv)
 
-__version__ = "v3.0.14-beta"
+__version__ = "v3.0.15-beta"
 
 __all__ = [
     # Main entry point

.bootstrap/.core/skills/cypilot/scripts/cypilot/commands/kit.py

@@ -1602,9 +1602,32 @@ def update_kit(
         # @cpt-end:cpt-cypilot-algo-kit-update:p1:inst-file-level-diff
 
         # @cpt-begin:cpt-cypilot-algo-kit-update:p1:inst-update-core-toml
-        # Update version in core.toml from source (always, even if some files declined)
-        if source_version:
-            _register_kit_in_core_toml(config_dir, kit_slug, source_version, cypilot_dir, source=source)
+        # Sync resource bindings: merge existing with new resources from manifest
+        _merged_resources: Optional[Dict[str, Dict[str, str]]] = None
+        if _manifest is not None:
+            # Read existing bindings from core.toml
+            _existing_bindings = _read_kits_from_core_toml(config_dir).get(kit_slug, {}).get("resources", {})
+            _merged_resources = {}
+            # Preserve existing bindings
+            for res_id, binding in _existing_bindings.items():
+                if isinstance(binding, dict):
+                    _merged_resources[res_id] = binding
+                elif isinstance(binding, str):
+                    _merged_resources[res_id] = {"path": binding}
+            # Add new resources from manifest (if not already present)
+            kit_root_rel = f"config/kits/{kit_slug}"
+            for res in _manifest.resources:
+                if res.id not in _merged_resources:
+                    # New resource — use default path
+                    binding_path = f"{kit_root_rel}/{res.default_path}"
+                    _merged_resources[res.id] = {"path": binding_path}
+
+        # Update version and resources in core.toml
+        if source_version or _merged_resources:
+            _register_kit_in_core_toml(
+                config_dir, kit_slug, source_version, cypilot_dir,
+                source=source, resources=_merged_resources,
+            )
         # @cpt-end:cpt-cypilot-algo-kit-update:p1:inst-update-core-toml
 
     # @cpt-begin:cpt-cypilot-algo-kit-update:p1:inst-collect-metadata

.bootstrap/.core/skills/cypilot/scripts/cypilot/utils/git_utils.py

@@ -37,7 +37,7 @@ def _redact_url(url: str) -> str:
     if "://" not in url and "@" in url and ":" in url:
         at_idx = url.index("@")
         return f"***{url[at_idx:]}"
-    # Standard URLs: https://user:pass@host/path
+    # Standard URLs: https://<user>:<token>@host/path
     from urllib.parse import urlsplit, urlunsplit
     parts = urlsplit(url)
     if parts.username or parts.password:

.bootstrap/.core/whatsnew.toml

@@ -148,4 +148,11 @@ details = """\
 - **Git URL sources** — standalone workspace files support remote Git repos with branch pinning and namespace rules
 - **Cross-repo ID resolution** — `validate` and `list-ids` gain `--local-only` and `--source` flags for workspace-aware operations
 - **WorkspaceContext** — context upgrade from `CypilotContext` with lazy loading and graceful degradation for unreachable sources\
+"""
+
+["v3.0.15-beta"]
+summary = "Secret scanner fix, kit update fix"
+details = """\
+- **Secret scanner fix** — sanitized high-entropy string in `git_utils.py` to avoid false positives from trufflehog3 and similar tools
+- **Fix: new manifest resources registered during kit update** — when a kit adds new resources in `manifest.toml`, `cpt kit update` now merges them into `core.toml` resource bindings instead of ignoring them\
 """

.bootstrap/.gen/AGENTS.md

@@ -8,7 +8,7 @@ ALWAYS open and follow `{cypilot_path}/.core/schemas/artifacts.schema.json` WHEN
 
 ALWAYS open and follow `{cypilot_path}/.core/architecture/specs/artifacts-registry.md` WHEN working with artifacts.toml
 
-# Cypilot Kit: SDLC (`cypilot-sdlc`)
+# Cypilot Kit: SDLC (`sdlc`)
 
 Agent quick reference.
 

.bootstrap/config/core.toml

@@ -7,7 +7,7 @@ project_root = ".."
 [kits.sdlc]
 format = "Cypilot"
 path = "config/kits/sdlc"
-version = "1.1.1"
+version = "1.2.0"
 source = "github:cyberfabric/cyber-pilot-kit-sdlc"
 
 [kits.sdlc.resources]
@@ -100,3 +100,6 @@ path = "config/kits/sdlc/SKILL.md"
 
 [kits.sdlc.resources.agents]
 path = "config/kits/sdlc/AGENTS.md"
+
+[kits.sdlc.resources.workflow_migrate_openspec]
+path = "config/kits/sdlc/workflows/migrate-openspec.md"

.bootstrap/config/kits/sdlc/AGENTS.md

@@ -1,4 +1,4 @@
-# Cypilot Kit: SDLC (`cypilot-sdlc`)
+# Cypilot Kit: SDLC (`sdlc`)
 
 Agent quick reference.
 

.bootstrap/config/kits/sdlc/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cypilot-sdlc
-description: "Artifacts: ADR, CODEBASE, DECOMPOSITION, DESIGN, FEATURE, PR-CODE-REVIEW-TEMPLATE, PR-REVIEW, PR-STATUS-REPORT-TEMPLATE, PRD; Workflows: pr-review, pr-status"
+description: "Artifacts: ADR, CODEBASE, DECOMPOSITION, DESIGN, FEATURE, PR-CODE-REVIEW-TEMPLATE, PR-REVIEW, PR-STATUS-REPORT-TEMPLATE, PRD; Workflows: migrate-openspec, pr-review, pr-status"
 ---
 
 # Cypilot Skill — Kit `sdlc`
@@ -114,6 +114,22 @@ When routed to PR status:
 3. Use `python3 {scripts}/pr.py` as the script
 4. When target is `ALL` or no PR number given, run `pr.py list` first to show available PRs
 
+## MIGRATION
+
+### Migration Commands
+- `cypilot migrate-openspec` — migrate OpenSpec artifacts to Cypilot SDLC documents
+
+### Migration Workflows
+
+ALWAYS route to the `cypilot-migrate-openspec` workflow WHEN user intent matches OpenSpec migration patterns:
+- `migrate openspec`, `migrate from openspec`, `convert openspec`
+- `cypilot migrate-openspec`, `openspec to cypilot`
+- Any request to convert OpenSpec artifacts to Cypilot SDLC format
+
+When routed to OpenSpec migration:
+1. Read `{workflow_migrate_openspec}` and follow its steps
+2. The workflow handles all configuration discovery and user interaction
+
 ## PRD
 
 ### PRD Commands