feat: 2026-05-27 research-driven update sweep (5 surface plugin + 9th audit check + supply-chain card)

.claude-plugin/commands/audit-cd.md

@@ -0,0 +1,22 @@
+---
+description: Check publish drift across destination registries — npm, PyPI, Open VSX, VS Marketplace, AMO (Firefox), GitHub Releases — via public read APIs. Read-only, makes outbound HTTPS.
+argument-hint: [path]
+---
+
+You are checking whether the local repo's declared version is **actually published** to each destination it claims.
+
+## Steps
+
+1. Call the `audit_cd` MCP tool with `path` set to the absolute path of the repo. If no path is given, use the MCP server's cwd.
+2. Surface per-destination drift:
+   - `in-sync` — local version matches the published latest
+   - `needs-publish` — local is ahead of published (CI/CD did not run, or token is missing)
+   - `local-stale` — published is ahead of local (someone else shipped)
+   - `not-found` — package/extension name not in registry yet
+   - `unsupported` — destination not auto-checkable (CWS, EAS, Railway, Fly, GHCR — explain why)
+3. For each `needs-publish`, suggest the publish path (tag push, OIDC trusted publisher config, etc.) — do not push the tag yourself.
+
+## Do NOT
+
+- Publish, tag, or trigger any release workflow. This tool is diagnostic only.
+- Treat `unsupported` destinations as failures — they require manual or auth-gated checks.

.claude-plugin/commands/audit-release.md

@@ -0,0 +1,23 @@
+---
+description: Diagnose release-readiness against the Starter Series quality bar — matched starter, version-vs-last-tag drift, CHANGELOG drift vs merged PRs, and publish-workflow kind. Read-only.
+argument-hint: [path]
+---
+
+You are auditing whether the current repo is **release-ready**.
+
+## Steps
+
+1. Call the `audit_release` MCP tool with `path` set to the absolute path of the repo the user is in. If no path is given, use the MCP server's cwd.
+2. Surface the structured report:
+   - **Ship-ready verdict** (`ready` / `needs-attention` / `blocked`)
+   - **Matched starter** (id + signals)
+   - **Version** (current, source, last tag, drift)
+   - **CHANGELOG** (file path, Unreleased section status, merged-PR drift)
+   - **Publish workflow** (file, kind)
+   - **Blockers / warnings**
+3. If `blocked`, propose concrete fixes (e.g., bump version, sync CHANGELOG Unreleased with merged PRs since last tag).
+
+## Do NOT
+
+- Modify the repo. This tool is diagnostic; the user decides how to fix.
+- Conflate with Anthropic's `/code-review` — that fixes correctness; this audits release/publish state.

.claude-plugin/commands/audit-security.md

@@ -0,0 +1,27 @@
+---
+description: Check baseline CI security hygiene against the Starter Series bar — gitleaks, CodeQL, dep audit, license check, --ignore-scripts, Dependabot grouped, secret-scanning, claude-code-security-review, claude-security-guidance. Read-only, complementary to Anthropic's in-session security guidance plugin.
+argument-hint: [path]
+---
+
+You are auditing the repo's **supply chain + CI security hygiene** as a complement to Anthropic's in-session `claude-security-guidance` plugin (in-session guard) and `claude-code-security-review` Action (post-PR review).
+
+## Steps
+
+1. Call the `audit_security` MCP tool with `path` set to the absolute path of the repo. If no path is given, use the MCP server's cwd.
+2. Surface the verdict (`hardened` / `needs-attention` / `soft`) and the table of checks:
+   - present / partial / missing / not-applicable
+   - Evidence (workflow files, config presence, gh-api result)
+   - Recommendation (for non-present items)
+3. For each `missing` or `partial`, propose the concrete add (workflow snippet, repo setting via `gh api`).
+
+## Positioning
+
+- **In-session guard** (Anthropic `claude-security-guidance` plugin, released 2026-05-26): catches vulnerabilities as code is written.
+- **Post-PR AI review** (`anthropics/claude-code-security-review` Action): reviews diffs on PR.
+- **Repo-level audit** (`audit_security`, this tool): verifies the static CI baseline is present and pinned.
+
+These three are **complementary**. Recommend installing all three when missing.
+
+## Do NOT
+
+- Modify the repo or repo settings. Suggest the `gh api` PATCH commands; let the user run them.

.claude-plugin/commands/graduate.md

@@ -0,0 +1,40 @@
+---
+description: Graduate a Lovable / Bolt / v0 export to GitHub Actions + a non-platform deploy target via the Starter Series 5-step path. Orchestrates the three audit MCP tools and surfaces lift-in steps for the matching starter.
+argument-hint: [path-to-export]
+---
+
+You are walking the user through the **vibe-coding-to-production graduation** path documented in `docs/graduation-from-vibe-coding.md`. The path is workflow-only — there is **no `graduate` MCP tool**; instead, this command orchestrates `audit_release`, `audit_cd`, and `audit_security`, then guides the lift-in and verify steps.
+
+## Steps
+
+1. **Diagnose** — Call all three MCP tools, in this order:
+   - Call the `audit_release` MCP tool with `path` set to the absolute path of the export repo.
+   - Call the `audit_cd` MCP tool with the same `path`.
+   - Call the `audit_security` MCP tool with the same `path`.
+
+   Surface gaps from each report. The matched starter id from `audit_release` determines the target in step 2.
+
+2. **Pick a target** — Map the matched starter (or app shape if `audit_release` returned `id: null`) to a Starter Series template:
+   - Next.js / Vite / React → `docker-deploy` (own VPS) or `cloudflare-pages` (static)
+   - Browser extension → `browser-extension` starter
+   - Discord/Telegram bot → matching bot starter
+   - Cross-platform desktop → `electron-app`
+   - Mobile → `react-native`
+   - Reusable library → `npm-package` or `python-mcp-server`
+
+3. **Lift CI/CD** — Copy `.github/workflows/` + Dockerfile (if applicable) + `.gitleaks.toml` from the matching starter. Replace placeholder owner/repo references with the user's current remote.
+
+4. **Wire secrets** — Run the per-target secret list from the guide. Prefer OIDC trusted publishing (npm, PyPI) where supported — zero long-lived tokens.
+
+5. **Seed security guidance** — Call the `seed_security_guidance` MCP tool with the same `path` to generate a starter `claude-security-guidance.md` tailored to the matched starter type.
+
+6. **Verify** — Re-call `audit_release`, `audit_cd`, `audit_security` on the now-graduated repo. Suggest the tag/push that triggers publish (do not push the tag yourself — npm publish is hard to undo).
+
+## Positioning (2026-05 framing)
+
+This is about **vendor diversity**, not "escaping" any platform. Vercel/Cloudflare/etc. have all evolved into "Agentic Infrastructure" providers — graduation gives the user a choice of multiple deploy targets, not a flight from one.
+
+## Do NOT
+
+- Tag a release or trigger publish on the user's behalf. This is destructive (npm publish is hard to undo).
+- Rewrite the user's app code. Only touch `.github/`, config files, CI scripts, and `claude-security-guidance.md`.

.claude-plugin/commands/scaffold.md

@@ -0,0 +1,20 @@
+---
+description: Scaffold a new project from a Starter Series template (Discord/Telegram bot, MCP server, browser/VS Code extension, Electron, React Native, Cloudflare Pages, npm package, Docker deploy).
+argument-hint: "[project-name] [--template <id>]"
+---
+
+You are scaffolding a new project from the **Starter Series** templates via the `create-starter` MCP server.
+
+## Steps
+
+1. If the user did not name a template, call `list_templates` and ask them to pick one.
+2. Collect required inputs:
+   - `name` *(required)* — must match `^[A-Za-z0-9][A-Za-z0-9_-]*$` (alnum start, then `[A-Za-z0-9_-]`). No dots, spaces, or path separators.
+   - `description` *(optional)* — one-line description that replaces the template default.
+3. Call `create_project` with the validated inputs.
+4. Report what was created, including the matched starter, files written, and any next-step commands from the post-scaffold report.
+
+## Do NOT
+
+- Shell out to `curl`, `tar`, or `git clone` — the MCP server handles fetch, extract, placeholder substitution, and `git init` atomically.
+- Run the new project's install/build/dev commands automatically — surface them to the user instead.

.claude-plugin/commands/seed-security-guidance.md

@@ -0,0 +1,35 @@
+---
+description: Generate a starter claude-security-guidance.md at the repo root tailored to the detected Starter Series template. Anthropic's Claude Code Security Guidance Plugin (released 2026-05-26) reads this file as an in-session guard.
+argument-hint: "[path] [--force]"
+---
+
+You are seeding a starter `claude-security-guidance.md` so Anthropic's Claude Code Security Guidance Plugin can use it as an in-session guard while writing code.
+
+## Steps
+
+1. Call the `seed_security_guidance` MCP tool with `path` set to the absolute path of the repo. If no path is given, use the MCP server's cwd. Pass `force: true` only when the user explicitly asks to overwrite an existing file.
+
+2. Surface the report:
+   - **status** — `created` (new file), `exists` (file present, no change), or `overwritten` (file was replaced because `force: true`).
+   - **matched starter** — which Starter Series template informed the starter-specific section. `null` means the generic fallback section was used.
+   - **relative path** — where the file landed (always `claude-security-guidance.md` at repo root for now).
+
+3. If `status === "exists"`, tell the user the file is already in place; offer to re-run with `--force` only if they want the latest template.
+
+4. If `status === "created" | "overwritten"`, suggest:
+   - Read the generated file and edit any org-specific rules in the marked sections.
+   - Commit via `git add claude-security-guidance.md && git commit -m "chore(security): seed claude-security-guidance.md"`.
+   - Re-run `audit_security` to confirm the `claude-security-guidance` check flips to PRESENT.
+
+## Positioning
+
+This complements (does not replace):
+- **`claude-code-security-review` GitHub Action** — runs on every PR, AI review of diffs.
+- **`audit_security` MCP tool** — detects this file's presence as the 9th check.
+
+The three together: in-session guard (this), post-PR review (`claude-code-security-review`), repo-level static audit (`audit_security`).
+
+## Do NOT
+
+- Pass `force: true` without explicit user confirmation — it overwrites any hand-edited rules.
+- Edit the file's content yourself from this command. Generate it via the MCP tool, then let the user edit.

.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     {
       "name": "create-starter",
       "source": ".",
-      "description": "Scaffold projects from the Starter Series templates — MCP server and Claude Code skill in one plugin."
+      "description": "Scaffold and audit Starter Series projects — slash commands, skill, MCP server, and CLI with release / CD / security audit primitives."
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,9 +1,10 @@
 {
   "name": "create-starter",
-  "version": "0.3.0",
-  "description": "Scaffold projects from the Starter Series templates — MCP server and Claude Code skill in one plugin.",
+  "version": "0.4.0",
+  "description": "Scaffold and audit Starter Series projects — slash commands, skill, MCP server, and CLI with release / CD / security audit primitives.",
   "author": {
-    "name": "heznpc"
+    "name": "heznpc",
+    "url": "https://github.com/heznpc"
   },
   "homepage": "https://github.com/starter-series/create-starter",
   "repository": "https://github.com/starter-series/create-starter",
@@ -13,6 +14,10 @@
     "starter",
     "scaffold",
     "template",
+    "audit",
+    "release",
+    "publish-drift",
+    "supply-chain-security",
     "claude-code",
     "bootstrap"
   ]

.github/workflows/publish.yml

@@ -56,24 +56,39 @@ jobs:
             exit 1
           fi
 
-      - name: Verify server.json version matches package.json
+      - name: Verify version sync across all 4 manifests
         run: |
-          if [ ! -f server.json ]; then
-            echo "::error::server.json not found at repo root"
-            exit 1
-          fi
-          SERVER_VERSION=$(node -e "console.log(require('./server.json').version)")
+          # 4 places hold version: package.json (source-of-truth), server.json,
+          # manifest.json (Claude Desktop .mcpb), .claude-plugin/plugin.json
+          # (Claude Code plugin). Drift between them produces visible-to-user
+          # version mismatch (e.g., Claude Desktop ext manager vs npm). Gate
+          # publish on parity.
+          PKG_VERSION="${{ steps.pkg.outputs.version }}"
+          declare -A FILES=(
+            [server.json]="server.json"
+            [manifest.json]="manifest.json"
+            [.claude-plugin/plugin.json]=".claude-plugin/plugin.json"
+          )
+          for path in server.json manifest.json .claude-plugin/plugin.json; do
+            if [ ! -f "$path" ]; then
+              echo "::error::$path not found at repo root"
+              exit 1
+            fi
+            V=$(node -e "console.log(require('./$path').version)")
+            if [ "$V" != "$PKG_VERSION" ]; then
+              echo "::error::$path version ($V) does not match package.json version ($PKG_VERSION)"
+              exit 1
+            fi
+            echo "  $path: $V"
+          done
+          # Also verify mcpName parity between server.json and package.json
           SERVER_NAME=$(node -e "console.log(require('./server.json').name)")
           PKG_MCP_NAME=$(node -e "console.log(require('./package.json').mcpName || '')")
-          if [ "$SERVER_VERSION" != "${{ steps.pkg.outputs.version }}" ]; then
-            echo "::error::server.json version ($SERVER_VERSION) does not match package.json version (${{ steps.pkg.outputs.version }})"
-            exit 1
-          fi
           if [ "$SERVER_NAME" != "$PKG_MCP_NAME" ]; then
             echo "::error::server.json name ($SERVER_NAME) does not match package.json mcpName ($PKG_MCP_NAME)"
             exit 1
           fi
-          echo "server.json verified: $SERVER_NAME@$SERVER_VERSION"
+          echo "All 4 manifests aligned at v$PKG_VERSION"
 
       - uses: actions/setup-node@v6
         with:
@@ -87,15 +102,20 @@ jobs:
       - name: Build
         run: npm run build
 
+      # `--provenance` is redundant under npm trusted publishing (GA 2025-07):
+      # the registry auto-generates and signs a provenance attestation when the
+      # publish call carries an OIDC token. Keeping the flag would be a stale
+      # signal — published behavior is identical. .mcpb gets its own SLSA
+      # attestation via attest-build-provenance below.
       - name: npm publish --dry-run
         if: inputs.dry_run == true
         run: |
           echo "=== DRY RUN: no tarball will be uploaded to the registry ==="
-          npm publish --provenance --access public --dry-run
+          npm publish --access public --dry-run
 
       - name: npm publish
         if: github.event_name == 'push' || inputs.dry_run == false
-        run: npm publish --provenance --access public
+        run: npm publish --access public
 
       - name: Build Claude Desktop Extension (.mcpb)
         run: npm run bundle:mcpb