build(deps): bump actions/setup-node from 4 to 7

.agents/plugins/marketplace.json

@@ -5,10 +5,10 @@
   },
   "plugins": [
     {
-      "name": "doable-trd-context",
+      "name": "doable-code-context",
       "source": {
         "source": "local",
-        "path": "./plugins/doable-trd-context"
+        "path": "./plugins/doable-code-context"
       },
       "policy": {
         "installation": "AVAILABLE",

.claude-plugin/marketplace.json

@@ -9,9 +9,9 @@
   },
   "plugins": [
     {
-      "name": "doable-trd-context",
-      "description": "Prepare one privacy-safe, evidence-grounded context file for a clearly identified feature before creating a Doable TRD.",
-      "source": "./plugins/doable-trd-context"
+      "name": "doable-code-context",
+      "description": "Resolve grounded Doable context requests or start a managed feature-testing workflow from the coding agent.",
+      "source": "./plugins/doable-code-context"
     }
   ]
 }

.cursor-plugin/marketplace.json

@@ -8,9 +8,9 @@
   },
   "plugins": [
     {
-      "name": "doable-trd-context",
-      "source": "./plugins/doable-trd-context",
-      "description": "Prepare one privacy-safe, evidence-grounded context file for a clearly identified feature before creating a Doable TRD."
+      "name": "doable-code-context",
+      "source": "./plugins/doable-code-context",
+      "description": "Resolve grounded Doable context requests or start a managed feature-testing workflow from the coding agent."
     }
   ]
 }

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Report a reproducible plugin or workflow problem
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        Do not include API keys, source code, customer data, private URLs, local paths,
+        or files from `.doable/`. Report security issues privately using SECURITY.md.
+  - type: dropdown
+    id: host
+    attributes:
+      label: Coding-agent host
+      options:
+        - Codex
+        - Claude Code
+        - Cursor
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: Plugin version and coding-agent host version
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: What happened?
+      description: Include sanitized steps, expected behavior, and actual behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: verification
+    attributes:
+      label: Sanitized diagnostics
+      description: Include only non-sensitive status or validation output.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security and privacy reports
+    url: https://github.com/getdoable/doable-agent-plugins/security/policy
+    about: Report suspected security or privacy issues privately.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Propose a plugin workflow or compatibility improvement
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What developer workflow is difficult today?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe the result without including private repository or customer data.
+    validations:
+      required: true
+  - type: dropdown
+    id: host
+    attributes:
+      label: Coding-agent host
+      multiple: true
+      options:
+        - Codex
+        - Claude Code
+        - Cursor
+        - Host-independent

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,15 @@
+## Summary
+
+<!-- What developer problem does this change solve? -->
+
+## Privacy and compatibility
+
+<!-- Note any privacy, authentication, manifest, or host-compatibility impact. -->
+
+## Verification
+
+<!-- List exact commands and fresh-session checks. State what was not tested. -->
+
+- [ ] `npm test`
+- [ ] No credentials, customer data, private URLs, local paths, or `.doable/` state included
+- [ ] Documentation and manifests updated when the public contract changed

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/validate.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - run: npm test
@@ -34,6 +34,6 @@ jobs:
             --output "${RUNNER_TEMP}/cursor-marketplace.schema.json"
           python scripts/validate-cursor-schema.py \
             "${RUNNER_TEMP}/cursor-plugin.schema.json" \
-            plugins/doable-trd-context/.cursor-plugin/plugin.json \
+            plugins/doable-code-context/.cursor-plugin/plugin.json \
             "${RUNNER_TEMP}/cursor-marketplace.schema.json" \
             .cursor-plugin/marketplace.json

.gitignore

@@ -2,3 +2,5 @@
 .doable/
 node_modules/
 *.log
+!tests/
+!tests/doable-code-context-helper.test.mjs

CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to Doable Agent Plugins are documented here.
+
+## [0.2.0] - Unreleased
+
+### Added
+
+- Doable Code Context for Codex, Claude Code, and Cursor.
+- MCP-backed pre-TRD context rounds with grounded, privacy-safe findings.
+- Coding-agent-first feature testing through the existing Doable suite, TRD, and managed-case workflow.
+- Demand-driven mono-repo and multi-repo workspace mapping with local-only provenance.
+
+### Changed
+
+- Replaced the legacy context-file workflow with MCP-backed context rounds and managed feature testing.
+- Added direct public setup instructions for Codex, Claude Code, and Cursor.
+
+### Security and privacy
+
+- Remote operations are isolated to the separately configured Doable MCP connection.
+- The bundled helper has no network or credential primitives.
+- Real repository identities, source locations, commits, local paths, and private artifacts remain local.

CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing
+
+Thanks for helping improve Doable Agent Plugins.
+
+## Before opening a change
+
+- Open an issue for a new workflow or a material contract change.
+- Keep each pull request focused on one plugin behavior.
+- Never include credentials, customer data, source excerpts, private URLs, local paths, or `.doable/` state.
+- Treat the privacy boundary in [PRIVACY.md](PRIVACY.md) as part of the public contract.
+
+## Validate locally
+
+Use Node.js 20 or newer and run:
+
+```bash
+npm test
+claude plugin validate ./plugins/doable-code-context
+```
+
+For host-specific changes, also validate the affected manifest and complete the relevant fresh-session checks in [TESTING.md](TESTING.md).
+
+## Pull requests
+
+Describe:
+
+- the user problem and intended behavior;
+- any privacy, authentication, or compatibility impact;
+- the commands and host versions used for verification;
+- what was not tested.
+
+Report security issues privately as described in [SECURITY.md](SECURITY.md), not in a public issue.

PRIVACY.md

@@ -1,12 +1,26 @@
 # Privacy and data handling
 
-The `doable-trd-context` plugin is a local, context-only workflow. Its code does not authenticate to Doable, call a Doable API or MCP server, upload files, or make network requests.
+Repository inspection happens inside the coding agent selected by the customer and remains subject to that agent provider's data-handling terms. The Doable plugin does not grant Doable repository access.
 
-Repository inspection happens inside the coding agent selected by the user and remains subject to that agent provider's own data-handling terms. The plugin writes two local files beneath `.doable/features/<feature-slug>/`:
+## Doable Code Context
 
-- `doable-context.md`, a privacy-scrubbed product-behavior document that the user may choose to upload to Doable;
-- `doable-intake.json`, a local provenance record that the plugin explicitly marks as not for upload.
+`doable-code-context` performs remote operations only through the configured Doable MCP connection. The coding agent host owns that connection's credential; the Skill and bundled helper neither read nor persist it.
 
-The uploadable context excludes source code and snippets, repository and file metadata, commit identifiers, secrets and environment values, raw logs and attachments, private URLs, and real customer or business data.
+Its local `.doable/workspace-candidate.json`, `.doable/workspace-private.json`, and `.doable/requests/` records may contain real repository identities, explicitly user-supplied artifact roots, local paths, Git provenance, exact evidence locators, and frozen Doable questions. They are written with private permissions and ignored by Git. Artifact roots are never serialized into the remote workspace profile.
 
-See the [Doable Privacy Policy](https://qa.getdoable.ai/privacy-policy) for the Doable platform's data handling. Questions may be sent to support@getdoable.ai.
+The helper validates every workspace profile and answer payload before the coding agent passes it to Doable MCP. Doable may receive only:
+
+- opaque workspace, repository, evidence, round, and question identifiers;
+- a sanitized workspace display name, product roles, surfaces, descriptions, feature scope, and externally observable findings;
+- truth planes, source types, observable anchors, exact user-authorized clarifications, explicit finding-to-finding conflicts, explicit unknowns, and nonblocking same-scope observations;
+- keyed fingerprints that cannot be reversed into a branch, commit, local path, or source span.
+
+Code evidence is always bound to an opaque repository reference and kept inside its mapped repository. A user-supplied PRD, screenshot, Figma export, or runtime capture outside Git is accepted only from an explicitly declared private artifact root; its remote evidence reference uses `repo_ref: null`, while its root, file name, path, and content remain local.
+
+The first profile upload and material role/surface/description changes require user approval. A specific round copy prompt authorizes pulling that frozen round and submitting its validated answers; idempotent retries do not create additional submissions.
+
+## Excluded data
+
+No remote payload may contain source code or snippets, real repository or file identities, branches or commits, secrets or environment values, raw logs or attachments, private URLs, internal infrastructure topology, or real customer/business data.
+
+See the [Doable Privacy Policy](https://qa.getdoable.ai/privacy-policy) for platform data handling. Questions may be sent to support@getdoable.ai.