update disco cli v0.2.0

Author: hanhainebula

cli/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 0.2.0 - 2026-08-26
+## 0.2.0 - 2026-08-27
 
 - Replace the legacy scenario-oriented repository router with a taxonomy-driven
   `area -> family -> repository skill -> relevant sub-skill` router. The
@@ -37,6 +37,49 @@
   reported by `status` and preserved across repository-skill updates.
 - Remove internal taxonomy design notes from the published taxonomy snapshot
   so the released router contains only runtime routing data.
+- Add `--creator` and `--researcher` as concise CLI mode selectors for new
+  sessions while retaining `--agent-mode creator|researcher` as a compatibility
+  form. Conflicting selectors, selector values, and incompatible resume/fork
+  combinations now fail with explicit diagnostics, and the CLI help, prompts,
+  and bundled documentation use the shorter forms.
+- Rework `import-repo-skills-to-agent` around a bundled transactional export
+  helper for Codex, Claude Code, and agent-neutral skill roots. Full and
+  selected exports now regenerate the target `repository-index.jsonl` and
+  scoped router deterministically, preserve unrelated target skills, require
+  per-skill overwrite approval, reject source/target overlap and symlinks, and
+  persist enough transaction state for automatic rollback and `--resume`
+  recovery after interruption.
+- Keep repository skills portable across agents by applying
+  `agents/openai.yaml` only to Codex target copies and excluding that target-only
+  policy from repository content digests. Align router refresh defaults with
+  the managed `skills/repositories/` collection layout.
+- Stop persisting per-repository `content_sha256` values in long-lived
+  repository indexes. Whole-index integrity digests and transaction-only
+  source snapshots remain available for safe export recovery, while the
+  one-time `skill_content_sha256` handoff check remains in verified imports.
+- Include DisCo's built-in extension packages in startup update discovery and
+  `disco update --extensions` / `disco update --extension` processing without
+  persisting them into user settings or installing missing defaults as an
+  update side effect. Legacy global npm installs are migrated into DisCo's
+  managed npm root when updated.
+- Add source-commit-bound GitHub license resolution to repository-skill creation,
+  refresh, extension, verification, collection build, and cross-agent export.
+  Every root and sub-skill now receives one shared top-level `license` value;
+  GitHub `NOASSERTION` is preserved, while unavailable queries use `NO_LICENSE`
+  and report the required manual follow-up.
+- Align the paper-oriented Creator meta-skill contracts around
+  `scope -> ground -> construct -> verify`, including task-agnostic and
+  task-oriented anchors, construction adequacy guidance, and the renamed
+  `construction-strategy-and-adequacy.md` reference.
+- Update the published collection contract to the current 1,000 repository
+  roots and 2,209 area-family memberships, and add the corresponding default
+  collection-build guard and regression coverage.
+- Require `@juicesharp/rpiv-todo@^2.7.1` so main, child, and detached sessions
+  use isolated Todo state and status changes preserve task creation order. Add
+  an isolated published-package contract verifier for session separation,
+  child cleanup, foreground ownership, task IDs, and stable ordering.
+- Upgrade `undici` to `8.10.0` and override `nanoid` to `3.3.18`, removing the
+  high-severity advisories previously reported by a source installation audit.
 
 ## 0.1.1 - 2026-08-03
 

cli/README.md

@@ -72,15 +72,15 @@ for the other documented update targets.
 Researcher is the default for a new session:
 
 ```bash
-disco --agent-mode researcher
-disco --agent-mode researcher -p "Reproduce this paper's primary result"
+disco --researcher
+disco --researcher -p "Reproduce this paper's primary result"
 ```
 
 Use Creator when the output is a reusable skill:
 
 ```bash
-disco --agent-mode creator
-disco --agent-mode creator -p "Inspect /path/to/repo and draft a skill creation plan"
+disco --creator
+disco --creator -p "Inspect /path/to/repo and draft a skill creation plan"
 ```
 
 In an interactive session, `/creator` and `/researcher` switch mode and rebuild

cli/docs/packages.md

@@ -215,6 +215,21 @@ Filter what a package loads using the object form in settings:
 - `-path` force-excludes an exact path.
 - Filters layer on top of the manifest. They narrow down what is already allowed.
 
+## Mode Targeting <a id="mode-targeting"></a>
+
+Use `disco install <source> --for ...` to set the default visibility of all
+resources from one package:
+
+| Target | Visible roles |
+|--------|---------------|
+| `creator` | Creator sessions |
+| `researcher` | Researcher sessions |
+| `both` | Creator and Researcher sessions |
+| `default` | Package default behavior |
+
+This changes package resource visibility without copying or splitting the
+package. Individual resource filters can further narrow the selected package.
+
 ## Enable and Disable Resources
 
 Use `disco config` to enable or disable extensions, skills, prompt templates, and themes from installed packages and local directories. `disco config` starts in global settings (`~/.disco/agent/settings.json`); press Tab to switch between global and project-local modes. Use `disco config -l` to start in project overrides (`.disco/settings.json`) with inherited global resources dimmed.

cli/docs/usage.md

@@ -161,6 +161,18 @@ These commands manage disco packages and `disco update` can update the disco CLI
 
 See [DisCo Packages](packages.md) for package sources and security notes.
 
+### Agent Modes
+
+| Flag | Description |
+|------|-------------|
+| `--creator` | Start a new session with Creator resources and workflow boundaries |
+| `--researcher` | Start a new session with Researcher resources and workflow boundaries |
+| `--agent-mode <mode>` | Compatibility form for `creator` or `researcher` |
+
+These selectors choose the Agent role and work with both interactive startup and
+non-interactive output. They are independent of `-p` / `--print` and
+`--mode text|json|rpc`.
+
 ### Modes
 
 | Flag | Description |

cli/npm-shrinkwrap.json

@@ -39,8 +39,9 @@
     "test": "vitest --run --config vitest.config.ts",
     "test:examples": "tsc --noEmit -p tsconfig.examples.json",
     "verify:provenance": "node scripts/upstream-provenance.mjs --check",
+    "verify:rpiv-todo-contract": "node scripts/verify-rpiv-todo-contract.mjs",
     "verify:package": "node scripts/verify-package.mjs",
-    "prepublishOnly": "npm run typecheck && npm test && npm run test:examples && npm run verify:provenance && npm run build && npm run verify:package"
+    "prepublishOnly": "npm run typecheck && npm test && npm run test:examples && npm run verify:provenance && npm run verify:rpiv-todo-contract && npm run build && npm run verify:package"
   },
   "dependencies": {
     "@earendil-works/pi-agent-core": "0.83.0",
@@ -60,7 +61,7 @@
     "proper-lockfile": "4.1.2",
     "semver": "7.8.0",
     "typebox": "1.3.7",
-    "undici": "8.5.0",
+    "undici": "8.10.0",
     "yaml": "2.9.0"
   },
   "optionalDependencies": {
@@ -82,6 +83,7 @@
     "vitest": "4.1.9"
   },
   "overrides": {
+    "nanoid": "3.3.18",
     "protobufjs": "7.6.5",
     "rimraf": "6.1.2",
     "gaxios": {