chore: sync private v4.8.4 (6739111)

.cursor-plugin/plugin.json

@@ -13,6 +13,6 @@
     "anti-slop"
   ],
   "license": "MIT",
-  "version": "4.8.3",
+  "version": "4.8.4",
   "repository": "https://github.com/agent-kit-startup/agent-kit"
 }

.cursor/agent-kit.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "4.8.3",
+  "version": "4.8.4",
   "protected": [
     ".cursor/HANDOFF.md",
     ".cursor/agents/test-suites.md",

.github/workflows/ci.yml

@@ -57,14 +57,17 @@ jobs:
   # Secret PUBLIC_REPO_TOKEN: fine-grained token with public repo Contents,
   # Pull requests, and merge (or auto-merge) permission. Repo must Allow auto-merge
   # when required checks exist. Opt out: PUBLIC_SYNC_AUTO_MERGE=false.
+  # Private-origin only: skip when this workflow runs on the public storefront
+  # slug (Path C mirrors ci.yml; public has no PUBLIC_REPO_TOKEN by design).
   # The secrets context is not allowed in job-level `if`; the guard step
-  # below fails loudly when the secret is unset on tag/manual sync paths.
+  # below fails loudly when the secret is unset on private tag/manual sync paths.
   sync-public:
     needs: build
     if: >-
-      startsWith(github.ref, 'refs/tags/v')
-      || (github.event_name == 'workflow_dispatch'
-          && github.event.inputs.sync_public == 'true')
+      github.repository != 'agent-kit-startup/agent-kit'
+      && (startsWith(github.ref, 'refs/tags/v')
+          || (github.event_name == 'workflow_dispatch'
+              && github.event.inputs.sync_public == 'true'))
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -105,11 +108,15 @@ jobs:
           GIT_AUTHOR_EMAIL: sync@agent-kit.dev
 
   # ── Publish @dadado/agent-kit-cli to npm (tag only) ──
+  # Private-origin only: skip on the public storefront slug (same Path C
+  # mirror as sync-public; npm publish belongs on agent-kit-dev).
   # Secret NPM_TOKEN: the publish step skips gracefully if not configured
   # (secrets context is not allowed in job-level `if`).
   publish-npm:
     needs: build
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: >-
+      github.repository != 'agent-kit-startup/agent-kit'
+      && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
       contents: read

CHANGELOG.md

@@ -8,6 +8,20 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and
 
 ## [Unreleased]
 
+## [4.8.4] - 2026-07-29
+
+### Fixed
+
+- Public storefront tag CI: skip `sync-public` and `publish-npm` when `github.repository` is `agent-kit-startup/agent-kit` so mirrored workflows do not fail on missing private-only secrets
+- Mission Control Flight Log: hover/focus border+outline follow typed kind palette tokens (ok green, advice/prompt blue, residual yellow, warning orange); Earlier stays muted; remove unset `--accent` yellow double ring
+
+### Changed
+
+- Mission Control Health (More → Health): Healthcenter UI for the same seven checks with live severity, expand/detail, and copy-only Autofix CTAs on both Interface Skins; snapshot error distinct from per-check fail
+- Mission Control chrome icons: align `spaceIconSvg` shell to refresh/`nowMetaIconSvg` (stroke 1.5); redraw Home house as one coherent glyph; add Skins palette affordance on More menu group label; leave logo assets untouched
+- Mission Control: main nav, mobile stack, and desktop 2x2 grid order is Current mission → Flight Log → Checklist → Crew Monitor (first nav label matches Current mission)
+- Docs: public-launch + repository-boundaries state mirror skip and private-only `PUBLIC_REPO_TOKEN`; verify checklist for next public `v*` tag
+
 ## [4.8.3] - 2026-07-29
 
 ### Fixed

README.md

@@ -104,11 +104,11 @@ The Cockpit reads as one page in four sections, each reachable from the primary
 | Section | What it answers |
 |---------|------------------|
 | Current mission | The plan in flight: status, progress, friendly Mode labels, and previous/current/next todo |
-| Crew Monitor | Live agent/crew feed: ticks, handoffs, deliveries, and denser `agent_step` rows for active-plan to-dos (cap 20) |
 | Flight Log | HANDOFF Gaps log (**Live** / **Earlier**, wipe on new flight; cap 15 within a flight) plus operator Warnings (Quota pause, Heads up); palette-by-type notification chrome (`ok` / `advice` / `prompt` / `residual` / `warning`); clipboard icon; clickable copy text/path; **All clear** when idle (no literal `none` as a yellow Live debit) |
 | Checklist | What remains: recent plan cards, parked and incomplete plans, and readiness notes |
+| Crew Monitor | Live agent/crew feed: ticks, handoffs, deliveries, and denser `agent_step` rows for active-plan to-dos (cap 20) |
 
-Plans, Activity, Agents, Skills, Commands, Health, Git, Memory, Terminals, Processes, and Config live in the More sections menu next to those links, with their counts.
+Plans, Activity, Agents, Skills, Commands, Health, Git, Memory, Terminals, Processes, and Config live in the More sections menu next to those links, with their counts. **Health** is a Healthcenter for the same seven workspace checks (`plans`, `handoff`, `agents`, `commands`, `memory`, `git`, `config`): live severity, expand/detail per check, and Autofix/Fix controls that only copy a command or path and name where to paste it (chat, terminal, or file picker). Snapshot/serve errors are distinct from per-check fails. Health does not reorder main cockpit tabs and does not duplicate Checklist readiness.
 
 Every action copies text and names where to paste it: repo-relative paths go to the file picker, slash commands to the chat input, chat references to the past-chat picker, and shell commands, PIDs, and commit shas to the terminal. The panel cannot open a file or a chat, and no label claims it can.
 

autogit/gitupdate.md

@@ -422,6 +422,7 @@ This section contains the detailed prompts that should be followed when commands
    | Check | How |
    |-------|-----|
    | Private tag CI | `gh run list` for the `vX.Y.Z` tag: `build`, `publish-npm`, and `sync-public` all green |
+   | Public storefront tag CI (advisory) | On `agent-kit-startup/agent-kit`, tag/Release runs should show `build` green with `sync-public` / `publish-npm` **skipped** (not failed). Do not treat a skipped public sync job as a private sync failure. |
    | npm | `npm view @dadado/agent-kit-cli version` matches the release |
    | Public sync PR **merged** | `sync-public` may open a PR; do **not** pass this row on CI-green alone. Confirm the public sync PR is **merged** (`gh pr view` / `gh pr list -R <public> --state merged`) before claiming public `main` is current |
    | Public `main` | Latest commit message like `chore: sync private vX.Y.Z (...)` on the public default branch **after** that merge |