Release v3.35.2

.changelogs/v3.35.2.md

@@ -0,0 +1,31 @@
+# Release v3.35.2
+
+Released: 2026-08-28
+
+## Highlights
+
+- **On-demand bundled libraries for Agent Skills environments.** For Antigravity CLI (`agy`), Codex, and Grok Build, slashdo now bundles conditional-path libraries into a local `lib/` directory alongside `SKILL.md` and loads them on demand with an explicit read directive, rather than inlining every branch into `SKILL.md`. This significantly trims the token footprint of installed skills like `/do:review`, `/do:pr`, and `/do:next`.
+- **`/do:next` swarm flow extracted.** The parallel swarm dispatch logic (Phases A–D) is now split into `lib/next-swarm.md`, keeping single-issue `/do:next` streamlined while providing the full swarm orchestration when `--swarm` is invoked.
+- **Installer and uninstaller hardening.** Bundled libraries are validated against symlink traversal and arbitrary path escaping (`assertSafeBundlePath`) during install, update, and uninstall. Empty skill directories are now cleanly removed upon uninstallation for directory-namespaced environments.
+- **Full multi-environment health and parity.** All 21 commands and bundled libraries maintain zero dangling link references and seamless AST-free transformation across Claude Code, OpenCode, Antigravity CLI, Codex, and Grok Build.
+
+## Added
+
+- `lib/next-swarm.md`: standalone library containing the complete parallel swarm workflow (Phases A–D) for `/do:next --swarm`.
+- `test/installer.test.js` & `test/transformer.test.js`: new test suites covering deferred lib bundling, cycle termination, list health with bundled dependencies, symlink traversal security guards, and uninstallation cleanup.
+
+## Changed
+
+- `src/transformer.js`: added `ON_DEMAND_LIBS`, `DEFERRED_LIBS`, `deferredLibDirective`, and AST-free markdown path transformation supporting sibling bundle references and relative linking.
+- `src/installer.js`: added `syncBundledLibs`, `bundledLibsAreEqual`, stale bundle pruning, and `assertSafeBundlePath` security checks.
+- `commands/do/next.md`: replaced inline swarm execution phases with a reference to `lib/next-swarm.md`.
+- `install.sh` & `uninstall.sh`: added `next-swarm` to the curl installer's library allowlist.
+
+## Fixed
+
+- `lib/multi-reviewer-loop.md`: updated documentation to reflect on-demand library resolution for Agent Skills hosts instead of legacy full inlining.
+- `src/installer.js`: ensured empty parent skill directories are removed during uninstallation of directory-namespaced skills.
+
+## Full Changelog
+
+**Full Diff**: https://github.com/atomantic/slashdo/compare/v3.35.1...v3.35.2

PRD.md

@@ -50,7 +50,7 @@ Aligned with [GOALS.md](./GOALS.md)'s Core Goals:
 | FR-2 | The system MUST support installing into an explicit subset of environments via `--env <envs>` (comma-separated, case-insensitive, trimmed), including the aliases `gemini`/`agy` → `antigravity`. | Must | `--env CLAUDE,agy` installs into the claude and antigravity targets only. |
 | FR-3 | The system MUST support installing/uninstalling a filtered subset of commands by name, accepting both bare (`push`) and `do:`-prefixed (`do:push`) forms. | Must | `npx slash-do@latest push pr` installs only the push and pr commands. |
 | FR-4 | The system MUST transform each source command file into the native format of its target environment — subdirectory layout for Claude Code, flat `do-<name>.md` for OpenCode, directory-per-skill (`SKILL.md`) for Antigravity/Codex/Grok — without per-environment hand-authoring. | Must | A single source file in `commands/do/` produces a correctly formatted, working command/skill file in every installed environment. |
-| FR-5 | For environments without `!cat` file-inclusion support, the system MUST inline referenced `lib/*.md` content directly into the transformed command file (recursively, with cycle termination) rather than leaving a broken path reference. | Must | No dangling `~/.claude/lib/<name>.md` references appear in Agent Skills output, even when the referenced file is missing. |
+| FR-5 | For environments without `!cat` file-inclusion support, the system MUST make every referenced `lib/*.md` reachable — inlining content into the transformed command file (recursively, with cycle termination), or, for a mutually-exclusive lib the run selects at most one of, writing it into the skill's own `lib/` directory and citing it by a relative path the agent reads on demand. Neither may leave a broken path reference. | Must | No dangling `~/.claude/lib/<name>.md` references appear in Agent Skills output, even when the referenced file is missing; every `lib/<name>.md` cited in a SKILL.md resolves to a file installed beside it. |
 | FR-6 | Re-running install MUST be idempotent — unchanged files report up to date, changed files are updated in place, and hooks/config are not duplicated. | Must | Two consecutive installs with no source changes report 0 updates on the second run. |
 | FR-7 | `--dry-run` MUST preview changes without writing, creating, or deleting any file, directory, hook registration, or config entry. | Must | A dry-run install on a clean host leaves the filesystem byte-for-byte unchanged. |
 | FR-8 | `--list` MUST show all commands and their install status per environment without making changes. | Must | Output lists every command with an installed/not-installed/outdated status per detected environment. |

README.md

@@ -454,7 +454,7 @@ npx slash-do@latest push pr release           # install specific commands only
   +------------------+
   |   Transformer    |  Converts format per environment:
   |                  |  - YAML frontmatter (Claude, OpenCode)
-  +------------------+  - Agent Skills / SKILL.md with inlined libs (Antigravity, Codex, Grok Build)
+  +------------------+  - Agent Skills / SKILL.md + bundled lib/ (Antigravity, Codex, Grok Build)
        |
        v
   +------------------+