feat(catalog): 每日候选扫描 2026-11-11

CHANGELOG.md

@@ -275,6 +275,22 @@ Catalogue additions from the 2026-11-10 evening candidate review.
 - `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were
   updated in the same change.
 
+Catalogue additions from the 2026-11-11 candidate review.
+
+- One installable skill, `retentioneering/retentioneering-tools`
+  (`retentioneering-product-analytics`), pinned to commit
+  `68f699f67674375c59ea26c6a719e91e83905f51` with archive SHA-256
+  `c0fe070c7ad6…`, recorded in `data-workflows`.
+- Four reference-only entries: `ast-grep/ast-grep` (structural search and
+  rewrite for the Python toolchain), `anthropics/claude-plugins-official`
+  (the 317-plugin Claude Code marketplace), `google/mantis` (agentic security
+  review: 19 skills plus an ADK harness) and `aoci-spec/aoci-code`
+  (local-first code-map MCP server, FSL-1.1-MIT).
+- The catalog now holds 116 entries: 49 installable resources (24 skills, 6 rule
+  packs, 17 MCP servers, and 2 LSP bridges) and 67 references.
+- `docs/CATALOG.md`, `docs/RESEARCH.md`, `docs/LSP.md`, and both READMEs were
+  updated in the same change.
+
 ## npm shell 0.1.1 — 2026-10-28
 
 - Honor HTTP/HTTPS proxy environment variables for GitHub runtime downloads,

README.md

@@ -17,7 +17,7 @@ Find useful, established GitHub projects for AI assisted development, then insta
 
 The installer is written in Python, with a dedicated Python toolkit. The collection also serves web and general software development across **Claude Code, Codex, Cursor, VS Code Copilot, and OpenCode**.
 
-The repository catalog includes **111 entries**: **48 installable resources** (23 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **63 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 47 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime.
+The repository catalog includes **116 entries**: **49 installable resources** (24 skills, 6 rule packs, 17 MCP servers, and 2 LSP bridges) and **67 references** (agent-lsp, mcpls, lspyx, 13 native language servers, and 51 other tools). Choose from **11 profiles** across **5 coding agents**. Repository `main` may include unreleased additions; `apd list --json` reports the catalog in your installed runtime.
 
 ## Contents
 

README.zh-CN.md

@@ -17,7 +17,7 @@
 
 安装器使用 Python 编写，并提供 Python 开发预设；整个集合也覆盖 Web 和通用软件开发。目前支持 **Claude Code、Codex、Cursor、VS Code Copilot 和 OpenCode**。
 
-仓库目录收录 **111 个条目**：**48 个可安装资源**（23 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **63 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、47 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。
+仓库目录收录 **116 个条目**：**49 个可安装资源**（24 个 skills、6 套规则、17 个 MCP servers、2 个 LSP 桥接），以及 **67 个参考条目**（agent-lsp、mcpls、lspyx、13 个原生语言服务、51 个其他工具）。提供 **11 种预设、5 种 coding agent** 适配。`main` 可能包含尚未发版的新增项，`apd list --json` 显示已安装 runtime 实际包含的工具目录。
 
 ## 目录
 

docs/CATALOG.md

@@ -1,6 +1,6 @@
 # Curated catalog / 精选目录
 
-Reviewed **2026-11-10**, catalog schema **2**. **111 entries**, with **48 installable/configurable integrations** and **63 reference-only tools**. The installable set contains 23 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references.
+Reviewed **2026-11-11**, catalog schema **2**. **116 entries**, with **49 installable/configurable integrations** and **67 reference-only tools**. The installable set contains 24 skills, 6 rule packs, 17 MCP servers, and 2 MCP-to-LSP bridges. The 18 LSP entries comprise the two installable bridges (Serena, lsp-mcp-server), the three reference-only bridges (agent-lsp, mcpls, lspyx), and 13 standalone language-server references.
 
 Stars are dated repository-level snapshots, not scores for individual skills or rules. Multiple entries from ECC, Superpowers, agent-skills, or another monorepo share the same repository evidence. The executable source of truth is [`catalog.json`](../src/awesome_python_dev/data/catalog.json); every entry records its source, license, review date, and installation status.
 
@@ -52,6 +52,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`graphify`](https://github.com/Graphify-Labs/graphify) | Build a local, deterministic knowledge graph of a repository, its docs, SQL schemas and configuration, and answer architecture, dependency and change-impact questions through a coding-agent skill with no vector store. | Reference only | 142,432 | Apache-2.0 |
 | [`brooks-lint`](https://github.com/hyhmrright/brooks-lint) | Six review modes for architecture decay, technical debt, test weakness, and remediation, using book-derived risk codes and a 0-100 health score, packaged for fourteen coding agents. | Reference only | 1,561 | MIT |
 | [`planning-with-files`](https://github.com/OthmanAdi/planning-with-files/tree/2362ca385ad74f061aa0e7b73f56543a4b7e6df2/skills/planning-with-files) | Keep the plan in files instead of context: `.planning/` plan, progress and findings documents, per-turn re-injection against context rot, session recovery after `/clear` or compaction, and a deterministic completion gate. | Install skill | 27,973 | MIT |
+| [`retentioneering`](https://github.com/retentioneering/retentioneering-tools/tree/68f699f67674375c59ea26c6a719e91e83905f51/.agents/skills/retentioneering-product-analytics) | Product analytics from user-level event logs: paths, transitions, funnels, segments, retention, step matrices and sequence patterns, with a bundled API map, analysis recipes and a log-inspection script. | Install skill | 946 | Apache-2.0 |
 
 ## Python, languages, and framework practices
 
@@ -85,6 +86,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`skillspector`](https://github.com/NVIDIA/SkillSpector) | Scan a skill directory, MCP server, Git URL, archive, or MCP registry snapshot for prompt injection, exfiltration, credential access, obfuscation, and supply-chain risk before installing it. | Reference only | 24,520 | Apache-2.0 |
 | [`pipelock`](https://github.com/pipelab-org/pipelock) | Mediate an agent's egress and MCP traffic against a policy file, scanning requests and responses and signing a receipt for every decision. | Reference only | 987 | Apache-2.0 |
 | [`trailofbits-skills`](https://github.com/trailofbits/skills) | Trail of Bits plugin marketplace of 47 Agent Skills for security review — audit context building, differential and variant analysis, Semgrep rule authoring, patch validation, supply-chain auditing — plus development workflows including `modern-python`, property-based testing and static analysis. | Reference only | 8,109 | CC-BY-SA-4.0 |
+| [`mantis`](https://github.com/google/mantis) | Run agentic vulnerability research as a method: history review, semantic index, threat model, hypothesis planning, deduplication, static verification, reproduction, chaining, adversarial patching and severity calibration, plus an ADK harness and a pull-request action. | Reference only | 2,759 | Apache-2.0 |
 
 ## Portable agent rules
 
@@ -126,6 +128,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`codeboarding`](https://github.com/CodeBoarding/CodeBoarding) | Render a codebase as interactive architecture maps plus Markdown, HTML, MDX or reStructuredText documentation for review and a coding agent's next prompt. | Reference only | 2,663 | MIT |
 | [`mcp-context-forge`](https://github.com/IBM/mcp-context-forge) | Federate MCP, A2A and REST/gRPC servers behind one governed endpoint with a registry, virtual servers, auth, rate limiting, and an admin UI. | Reference only | 4,752 | Apache-2.0 |
 | [`powercontext`](https://github.com/oceanbase/powercontext) | Server-side memory, handoff and experience layer for coding agents, exposed as an HTTP contract with a Python client, CLI, dashboard and a curated MCP projection over revisioned artifacts. | Reference only | 1,575 | Apache-2.0 |
+| [`aoci-code`](https://github.com/aoci-spec/aoci-code) | Keep a Git-versioned, agent-written map of a repository's code, configuration, tests and database schema through a local Go MCP server, so an agent reads the index instead of re-reading the tree. | Reference only | 1,897 | FSL-1.1-MIT |
 
 ## Language intelligence and LSP
 
@@ -173,6 +176,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`skillsaw`](https://github.com/stbenjam/skillsaw) | Lint, autofix and baseline the skills, plugin manifests, hooks and instruction files a coding agent loads across the major agent ecosystems. | Reference only | 71 | Apache-2.0 |
 | [`agents-cli`](https://github.com/google/agents-cli) | Seven Agent Skills plus a CLI for building, evaluating, deploying, observing and publishing ADK agents on Google Cloud. | Reference only | 6,315 | Apache-2.0 |
 | [`agent-skills-spec`](https://github.com/agentskills/agentskills) | The Agent Skills specification plus `skills-ref`, the Python reference validator that checks a skill directory and renders the properties and prompt block a client would load. | Reference only | 27,113 | Apache-2.0 |
+| [`claude-plugins-official`](https://github.com/anthropics/claude-plugins-official) | Anthropic's vetted Claude Code plugin marketplace: 317 skills, agents, hooks, commands and MCP servers plus 14 partner plugins, installed with `/plugin install <name>@claude-plugins-official`. | Reference only | 46,870 | Apache-2.0 |
 
 ## Python project toolchain
 
@@ -186,6 +190,7 @@ Profiles select relevant tools instead of loading every available rule and frame
 | [`orm-lens`](https://github.com/FROWNINGdev/orm-lens) | Answer Django model questions over MCP from static parsing — relations, ER diagrams, migration risk, N+1 candidates, and schema drift — with SQLAlchemy preview support. | Configure MCP | 96 | MIT |
 | [`misata`](https://github.com/rasinmuhammed/misata) | Declare the facts a dataset must hold and get multi-table synthetic test rows over MCP, with a certificate a DuckDB run re-checks, next to a CLI and a pytest plugin. | Configure MCP | 75 | MIT |
 | [`mustel`](https://github.com/mustel-py/mustel) | Run Ruff, Bandit, Oxlint and pip-audit over MCP for the project it is launched in, with a compressed AST code map and an audit mode for dependency vulnerabilities. | Configure MCP | 19 | MIT |
+| [`ast-grep`](https://github.com/ast-grep/ast-grep) | Search, lint and rewrite code by AST pattern instead of text, over tree-sitter grammars including Python, installed as the `ast-grep-cli` package in a project environment. | Reference only | 16,554 | MIT |
 
 ## Building MCP integrations
 
@@ -207,6 +212,7 @@ Skill and rule archives are pinned to full commits and verified against a record
 | [affaan-m/ECC](https://github.com/affaan-m/ECC/tree/25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b) | `25278e7d7b6cf6e6a4e7a6c8e10f14ff22f0eb5b` | `7979cc21e2093aed6218fa1709373eff5eb8641b0c0a5128c68db91bbedd7bb1` |
 | [addyosmani/agent-skills](https://github.com/addyosmani/agent-skills/tree/aeac41d4d005999432bb7312f7ff06383a91d59d) | `aeac41d4d005999432bb7312f7ff06383a91d59d` | `0211a580aab7d45c73886d6f96d2f0679416119b4f9add08b6ceea5c0c15fbf1` |
 | [OthmanAdi/planning-with-files](https://github.com/OthmanAdi/planning-with-files/tree/2362ca385ad74f061aa0e7b73f56543a4b7e6df2) | `2362ca385ad74f061aa0e7b73f56543a4b7e6df2` | `cf60990c520c8f5d6fff876524450ce67172ad8ce785213a9bc50dbb06ac2227` |
+| [retentioneering/retentioneering-tools](https://github.com/retentioneering/retentioneering-tools/tree/68f699f67674375c59ea26c6a719e91e83905f51) | `68f699f67674375c59ea26c6a719e91e83905f51` | `c0fe070c7ad635c57b69f4d24ce394b6f21664c234ccdcf24db49af554568781` |
 
 | Service | Pinned launcher | Runtime / setup |
 | --- | --- | --- |
@@ -300,3 +306,8 @@ Admission considers the coding task served, documented setup, maintenance activi
 See [research and verification evidence](RESEARCH.md), [ECC migration details](ECC-MIGRATION.md), [LSP and security-tool setup](LSP.md), and [agent configuration paths](AGENTS.md).
 
 **Updates are curated and pinned.** Refreshing installed instructions regenerates them from the catalog shipped with this CLI version. It does not watch upstream repositories, follow their default branches, or silently adopt new skills/rules. A catalog update requires reviewing upstream changes and licenses, selecting a new pin, recomputing archive hashes where applicable, updating these documents, and testing the installation lifecycle.
+- **ast-grep:** [Structural search, linting and rewriting by AST pattern](https://github.com/ast-grep/ast-grep) rather than by text, which is the difference that matters when an agent is asked to change every occurrence of one code shape across a project. It stays reference-only because the delivered unit is a native CLI built from a Rust workspace (`crates/`: `cli`, `core`, `language`, `config`, `dynamic`, `lsp`, `outline`, `napi`, `pyo3`, `wasm`) and not one of this catalog's install types: the Python route is the published package `ast-grep-cli` (root `pyproject.toml`, built with maturin from `crates/pyo3`), which belongs in a project environment next to `ruff` and `deptry` rather than in a client configuration, and the CLI's own `lsp` subcommand (`crates/cli/src/lsp.rs`) serves ast-grep rule diagnostics to an editor rather than the Python language intelligence the LSP entries here provide. Python patterns are parsed by `crates/language/src/python.rs`. Nothing was installed and no search or rewrite was run.
+- **claude-plugins-official:** [The directory Anthropic maintains for Claude Code plugins](https://github.com/anthropics/claude-plugins-official): `.claude-plugin/marketplace.json` lists 317 plugins — skills, agents, hooks, commands and MCP servers — installed with `/plugin install <name>@claude-plugins-official`, with 14 partner entries under `external_plugins/` and the first-party ones grouped under `plugins/`. It is reference-only because a marketplace is a catalogue of pointers: each plugin resolves to its own repository, subdirectory or version tag, so there is no single subtree to pin and verify — the same reason recorded for `trailofbits/skills` and `anthropics/skills`. Use it to choose a plugin, including the MCP servers already recorded here (`serena`, `context7`, `playwright`, `github`), and note the README's own boundary: Anthropic does not control the MCP servers, files or software inside third-party plugins and cannot verify they behave as intended. Nothing was installed and no plugin was activated.
+- **mantis:** [Agentic vulnerability research as an orchestrated method](https://github.com/google/mantis) rather than another scanner: `skills/` holds 19 skills (`mantis-threat-model`, `mantis-history`, `mantis-structural-index`, `mantis-plan`, `mantis-researcher`, `mantis-reproduce`, `mantis-patch`, `mantis-critic`, `mantis-dedupe`, `mantis-calibrate`, `mantis-chain`, `mantis-reflect`, `mantis-report`, `mantis-advise` and the rest) and `reference/` is a Google ADK harness that runs the same pipeline over a target checkout, with a second copy of the method inside the harness and an `action/` variant for pull requests. It stays reference-only because the useful unit is that collection plus a harness needing a model provider (Vertex AI or an API key) and a target repository, not one pinnable skill directory an installer can copy — and because upstream states that findings and patches produced this way must be verified by a security expert before being reported and that the pull-request scan is untested end to end and must not gate merges. Recorded in `security` next to `trailofbits-skills` as the orchestration layer in front of the scanners already listed there. Nothing was installed, no campaign was run and no code was scanned.
+- **retentioneering:** Product analytics where this catalog previously had schema and migration tooling but no lane for user behaviour. `SKILL.md` plus its bundled `references/` (analysis recipes, API map, gotchas and validation) and `scripts/inspect_event_log.py` take an agent from user-level event logs to paths, transitions, funnels, segments, retention, step matrices and sequence patterns, and every path the skill names resolves inside its own directory, so the pinned archive recipe copies a working unit. It is the only installable addition in this pass; the same repository also publishes the `retentioneering` Python package (5.3.0, Python >=3.11) and an MCP server that the skill calls, and the recipe installs only the skill, so the environment it analyses data in still needs the library. Nothing was installed and no dataset was analysed.
+- **aoci-code:** A [local-first Go MCP server](https://github.com/aoci-spec/aoci-code) that keeps the agent's own map of a repository — one line per file in `aoci.txt`, with `aoci.code.txt` and `aoci.meta.txt` alongside, committed to Git and re-verified against the tree as work lands — so an agent reads the index instead of re-reading the codebase; it is the same problem `codebase-memory-mcp`, `chunkhound` and `code-review-graph` address by indexing for retrieval, with a file the model writes and Git versions instead. It is reference-only because delivery is a release binary (`go.mod`, `Makefile`, `cmd/`, `engine/`, `internal/`, `.goreleaser.yml`) that a project registers itself, and because the repository carries the Functional Source License 1.1 with an MIT future license (`LICENSE`; the GitHub API reports `NOASSERTION` for the adapted header), which permits non-competing use today and converts to MIT later — a second reason nothing from its `spec/`, `docs/` or `AGENTS.md` text is copied into this repository. Upstream also ships `NOTICE`, `PATENTS`, `TRADEMARKS`, `THIRD-PARTY-NOTICES`, a Glama listing and bilingual READMEs. Nothing was installed and no index was built.