chore(release): release 5 plugins

docs/conventions/pr-pipeline/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog for the PR pipeline convention
 
+## [2.19.2] - 2026-10-20
+
+### Changed
+
+- Write lanes deny the shell commands that can print a file or the environment (`echo`, `printf`, `cat`, `head`, `tail`, `grep`, `find`, `env`, `printenv`, `strings`, `od`, `xxd`, `diff`, `sed`, `awk`, `sort`, `cut`, `tr`, `base64`, `nl`, `tac`, `rev`, `uniq`, `fold`, `column`, `jq`, `xargs`, `more`, `less`) and `Read` of `/proc`; the skill reads files with `Read`, `Grep` and `Glob`. `resolve-issue` fetches only the Claude Code, Claude platform, GitHub, Node.js and Python docs hosts, and no longer runs `scripts/run-test-file.sh` or `check-skill.sh`; the pull request's CI runs the tests ([pr-run-activity.md](https://github.com/melodic-software/claude-code-plugins/blob/main/docs/conventions/pr-pipeline/pr-run-activity.md)).
+
 ## [2.19.1] - 2026-10-20
 
 ### Fixed

plugins/ai-slop/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-slop",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "Detects and removes AI-writing tells (slop) in tracked markdown prose: em dashes, emoji formatting, AI vocabulary, negative parallelisms, chatbot phrases, filler, stacked hedging, citation artifacts, and model-era phrases, from a catalog based on Wikipedia's Signs of AI writing plus an evidence-graded model-vocabulary inventory. Read-only audit by default (deterministic detector plus judgment rubric); an explicit fix action rewrites findings behind a semantic-diff guard.",
   "author": {
     "name": "Melodic Software",

plugins/ai-slop/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.14.4] - 2026-10-20
+
+### Fixed
+
+- `audit`: the effective-config line runs the detector alone, with no pipe into `head -40`, so it loads in a CI lane whose deny rules name `head`.
+
 ## [0.14.3] - 2026-10-20
 
 ### Fixed

plugins/context7/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context7",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Looks up current library documentation, API references, and code examples via Context7 (ctx7 CLI or the Context7 MCP server) with a two-step resolve-then-query workflow: a lookup skill (default lookup plus an upstream drift-check action) and a setup skill for CLI install, auth, and MCP configuration.",
   "author": {
     "name": "Melodic Software",

plugins/context7/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `context7` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.1] - 2026-10-20
+
+### Changed
+
+- lookup: re-synced the vendored find-docs baseline to upstash/context7@158ad262 and updated the latest-version example queries from Next.js middleware to proxy, matching the Next.js 16 rename.
+
 ## [0.8.0] - 2026-10-20
 
 ### Changed

plugins/planning/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "planning",
-  "version": "0.78.1",
+  "version": "0.79.0",
   "userConfig": {
     "surface": {
       "type": "string",

plugins/planning/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to the `planning` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.79.0] - 2026-10-20
+
+### Added
+
+- Shared interview page: a guest waiting for the host to let them in sees one centered card with the session title, "Why you're here" and the wait, and nothing else of the session until admitted; the server's waiting refusal carries the title and intro.
+- Shared interview page: guests get their own Pop-ups switches in the Inbox's Notifications tab (Claude answered my request, a mention, a new round), all on until turned off.
+- Shared interview page: the full-screen Inbox uses two columns from 1100 px (Needs you side by side; Pop-ups and the notification switches in a sticky column beside the messages), and below that keeps the messages first with Pop-ups and the switches behind one "Pop-ups and notifications" button; "Show in Host view" sits in each row's own actions.
+- Shared interview page: the tour adds the Discussion, Ask Claude with @Claude, attaching a file and the Inbox for guests, and Share, Needs you (Run and Approve) and Send for the host.
+- Shared interview page: a guest's desktop Help has Settings, which opens their own card.
+- Shared interview page: the host's Pop-ups gain "Someone offers a file", off until switched on; on, a file a guest offers pops up for the host.
+
+### Changed
+
+- Shared interview page: every popover, panel and sheet opens through one surface model with one close x named for what it closes, one focus trap and one 720 px breakpoint, so the Ask Claude panel is a side drawer down to phone width.
+- Shared interview page: Help and More draw one menu model; chat messages and Discussion comments share one message menu (Reply, React, Propose as question, Ask Claude about this, Copy, and Edit, Delete or Hide where allowed), opened by ⋯ or a long press.
+- Shared interview page: person, proposal, request and result actions each come from one builder, with the same words and toasts in the person card, Host view, person view, Settings, Proposed, the queue, Later, the thread, Ask Claude and the Inbox; every Copy uses one copy path.
+- Shared interview page: sending a round with open questions, and declining a request, join or merge, ask first through the one confirm dialog.
+- Shared interview page: a toast is the result of the person's own action or a pop-up they switched on, and never a kind they muted; everything else from others waits in the Inbox.
+
+### Fixed
+
+- Shared interview page: the question's Ask Claude button no longer claims a menu it does not open.
+- Shared interview page: a prototype page reads as read-only for a guest once the session ends or they are removed.
+- Shared interview page: an answer's device badge names the browser in words, from the one device and browser source.
+
 ## [0.78.1] - 2026-10-20
 
 ### Changed

plugins/skill-quality/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skill-quality",
-  "version": "0.30.1",
+  "version": "0.31.0",
   "description": "Skill-authoring QA tooling (skill-quality:check): a static contract checker running thirty deterministic checks over a Claude Code skill (frontmatter, invocation mode, description, listing cap, trigger keywords, line caps, broken refs, markdownlint, gotchas, evals), a shared skill-listing budget reporter, an evals.json schema with an eval-quality lint, and a measure-invocation harness that scores description auto-invocation probes on train and validation splits.",
   "author": {
     "name": "Melodic Software",

plugins/skill-quality/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `skill-quality` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.31.0] - 2026-10-20
+
+### Added
+
+- Check 8 also accepts a `vendor/` change paired with a `metadata.upstream-sha` bump that equals the content hash it recomputes offline (SHA-256 of the single vendored non-dotfile with CR removed, or of the sorted per-file hash lines for several files), so a resync whose upstream changed bytes without a version bump passes. A sha that does not match fails, naming both hashes.
+
 ## [0.30.1] - 2026-10-20
 
 ### Fixed