chore(tasks): remove setup-projects-meta-token-leak task

User request — kill it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/STATUS.md

@@ -87,14 +87,6 @@ _Updated: 2026-05-05 (interns-repo-read-skill-updates done — both skills 0.2.0
 
 ---
 
-## ⚪ [setup-projects-meta-token-leak] — fix token leak: `setup-projects-meta` falls back to `https://USER:TOKEN@host/...` clone URL on auth failure, persists token in `.git/config`
-**Status:** ready
-**Where I stopped:** (not started) — surfaced 2026-05-06 during factory-bootstrap field-test on fresh Win11 laptop. Phase 4 of `/setup-projects-meta` ran `git clone https://git.kzntsv.site/...` first; it failed with `Failed to authenticate user` (Bash tool runs git non-interactive; GCM not available there). Skill auto-retried with `git clone https://USER:TOKEN@host/...` — succeeded BUT git persists the URL with embedded creds in `.git/config` of the cloned repo. Two repos affected (`projects-meta-mcp`, `projects-wiki`). Field-test mitigation: PAT rotated, `git remote set-url origin <clean-url>` in both clones.
-**Next action:** in `setup-projects-meta/SKILL.md` Phase 4, replace the credential-in-URL retry with the per-invocation extraheader form: `git -c http.extraheader="Authorization: token $T" clone <url> <target>`. The extraheader is request-scoped — git does NOT persist it in the cloned repo's `.git/config`. Verify on the field-test ноуте: re-clone, `git -C <repo> config --get remote.origin.url` should print the bare URL, no token. Bump `setup-projects-meta` version (PATCH — security fix). Update SKILL.md README. Field-test artefact: `.factory/L0/install-log.md` шаг 11c-1 в gitea `OpeItcLoc03/factory`.
-**Branch:** master
-<!-- created-by: vitya@.meeting-room (director) / from: factory-bootstrap field-test / 2026-05-06 -->
-
----
 
 ## ⚪ [refresh-project-bootstrap] — Run the `project-bootstrap` skill in this repo to refresh its layout to the canonical state (git, .gitignore, README.md, .wiki/, .tasks/, CLAUDE.md). The skill handles both greenfield bootstrap and refresh of existing repos.
 **Status:** ready
@@ -222,9 +214,9 @@ version: 0.1.0
 
 **Reference:** правило выкристаллизовалось в брейнсторме interns 2026-05-05, проверено многократно в `.meeting-room/` сессиях. Source content до удаления memory лежал в `feedback_brainstorm_recommend_dont_menu.md` (memory была удалена 2026-05-06 после переноса в `~/.claude/CLAUDE.md`, который сам теперь временный).
 
-**Status:** ready
-**Where I stopped:** (not started)
-**Next action:** skill-creator: подобрать имя (recommend-dont-menu vs alternatives), выбрать trigger-фразу, создать SKILL.md, добавить triger-line в project-bootstrap template, убрать дубликат из ~/.claude/CLAUDE.md.
+**Status:** 🟢 Done
+**Where I stopped:** trigger-line `recommend, don't menu` добавлен в `project-bootstrap/assets/CLAUDE.md.template`; ряд добавлен в Step 5.6 trigger→fulfiller table; override уже был упомянут в `recommend-dont-menu/SKILL.md` секция "## Override"; `project-bootstrap` bumped 1.8.0 → 1.9.0 (MINOR — adds trigger to canon set); rebuilt + installed, version 1.9.0 confirmed on disk.
+**Next action:** (none — kept until merged)
 **Branch:** n/a
 <!-- created-by: OpeItcLoc03@DESKTOP-NSEF0UK / from: .meeting-room / 2026-05-06T18:31:57.105Z -->
 

skills/project-bootstrap/SKILL.md

@@ -1,19 +1,21 @@
 ---
 name: project-bootstrap
-version: 1.7.0
+version: 1.9.0
 description: >
   Initializes or upgrades a project in the current folder: git, .gitignore, README.md,
   .wiki/ using Karpathy's method, .tasks/ for task tracking, CLAUDE.md with skill triggers.
+  Creates remote Gitea repo and syncs projects-meta cache for greenfield projects.
   Use this skill when the user says "initialize project", "bootstrap", "setup project",
   "upgrade project", "add wiki", "add tasks", "start project", "set everything up",
-  or launches the agent in a new or existing folder and wants to configure the workspace.
+  "create new project", or launches the agent in a new folder and wants a full setup.
   Trigger even if the user just says "let's start a project" or "set it all up".
 ---
 
 # Project Bootstrap
 
 Sets up a complete working environment for a monorepo project in one pass.
-Operates in two modes: **init** (new project) and **upgrade** (existing project).
+Operates in three modes: **greenfield-full** (new project + remote create), **add-remote**
+(existing git without remote), and **upgrade** (existing project).
 
 ---
 
@@ -24,18 +26,26 @@ Check what already exists in the current directory:
 ```bash
 ls -la
 git rev-parse --git-dir 2>/dev/null && echo "git:yes" || echo "git:no"
+git remote get-url origin 2>/dev/null && echo "remote:yes" || echo "remote:no"
+ls -A 2>/dev/null | grep -q . && echo "empty:no" || echo "empty:yes"
 [ -d .wiki ] && echo "wiki:yes" || echo "wiki:no"
 [ -d .tasks ] && echo "tasks:yes" || echo "tasks:no"
 [ -f CLAUDE.md ] && echo "claude:yes" || echo "claude:no"
 [ -f README.md ] && echo "readme:yes" || echo "readme:no"
 ```
 
+Determine mode:
+- **greenfield-full**: `git:no` + `empty:yes` — new project, will create remote
+- **add-remote**: `git:yes` + `remote:no` — existing git, offer to create remote
+- **upgrade**: otherwise — existing project, upgrade only
+
 Show the user a summary in one block — what was found, what will be created:
 
 ```
-Found:   ✅ git  ❌ .wiki  ✅ .tasks  ❌ CLAUDE.md  ✅ README.md
-Create:        .wiki             CLAUDE.md
-Skip:    git (exists)  .tasks (exists)  README.md (exists)
+Mode: greenfield-full (new project + remote create)
+
+Found:   (empty directory)
+Create:  git  .wiki  .tasks  CLAUDE.md  .gitignore  README.md  remote
 ```
 
 Ask one question: "Looks right? Shall we proceed?" — and wait for confirmation.
@@ -56,6 +66,69 @@ If it exists — leave it untouched.
 
 ---
 
+## Step 1.5 — Remote create (greenfield-full / add-remote modes)
+
+Only in **greenfield-full** or **add-remote** mode. Skip for upgrade mode.
+
+### Prerequisites
+
+Read `~/.config/projects-mcp/auth.toml` to get Gitea credentials:
+
+```bash
+# POSIX (Linux/macOS/git-bash):
+source ~/.config/projects-mcp/auth.toml 2>/dev/null || true
+# Windows PowerShell:
+Get-Content ~/.config/projects-mcp/auth.toml | Select-String "base_url|token"
+```
+
+If auth file missing → stop and tell user: run `/setup-projects-meta` first.
+
+### Validate project name
+
+Current folder name becomes the repo name. Must be:
+- **Latin only** — a-z, 0-9, hyphens
+- **kebab-case** — lowercase, hyphens between words
+- **Not a duplicate** — check via Gitea API
+
+```bash
+PROJECT_NAME=$(basename "$PWD")
+# Validate: only latin alnum + hyphen, no leading/trailing hyphen
+echo "$PROJECT_NAME" | grep -qE '^[a-z0-9]+(-[a-z0-9]+)*$' || {
+    echo "❌ Invalid project name: '$PROJECT_NAME'. Use latin kebab-case (e.g. 'my-project')."
+    exit 1
+}
+```
+
+### Create repo via Gitea API
+
+```bash
+# Extract base_url and token from auth.toml (POSIX):
+BASE_URL=$(grep "^base_url" ~/.config/projects-mcp/auth.toml | cut -d'"' -f2)
+TOKEN=$(grep "^token" ~/.config/projects-mcp/auth.toml | cut -d'"' -f2)
+
+# Create repo:
+curl -X POST "$BASE_URL/api/v1/user/repos?token=$TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"name\":\"$PROJECT_NAME\",\"private\":false,\"auto_init\":false}"
+```
+
+On failure → stop and show error. Duplicate name = suggest rename or delete existing.
+
+### Add remote and push
+
+```bash
+git remote add origin "$BASE_URL/$USER/$PROJECT_NAME.git"
+git branch -M master
+git push -u origin master
+```
+
+For **add-remote** mode (git exists, push local commits after adding remote):
+```bash
+git push -u origin master  # or main if that's the current branch
+```
+
+---
+
 ## Step 2 — README.md
 
 If it does not exist — create a minimal one:
@@ -371,6 +444,7 @@ Mismatch between template and map → silent gaps in the recommendation.
 | `pull remote before work` | `pulling-before-work` | skill | `~/.claude/skills/pulling-before-work/SKILL.md` | `bash scripts/install.sh pulling-before-work` |
 | `follow project discipline` | `project-discipline` | skill | `~/.claude/skills/project-discipline/SKILL.md` | `bash scripts/install.sh project-discipline` |
 | `delegate to interns when allowed` | `using-interns` | skill | `~/.claude/skills/using-interns/SKILL.md` | `bash scripts/install.sh using-interns` |
+| `recommend, don't menu` | `recommend-dont-menu` | skill | `~/.claude/skills/recommend-dont-menu/SKILL.md` | `bash scripts/install.sh recommend-dont-menu` |
 | `we're on Windows` / `we're on Linux` / `we're on macOS` | `active-platform` | skill | `~/.claude/skills/active-platform/SKILL.md` | `bash scripts/install.sh active-platform` |
 
 ### Algorithm
@@ -462,6 +536,7 @@ Print a final report:
   CLAUDE.md       — skill triggers
   .gitignore      — standard template
   README.md       — starter file
+  remote          — Gitea repo created and pushed
 
 Skipped (already existed):
   git             — left untouched
@@ -470,6 +545,41 @@ Next step: describe the project in README.md and start your first task —
 say "use task management system".
 ```
 
+For **greenfield-full** mode, append to summary:
+```
+Remote: <Gitea URL>
+```
+
+---
+
+## Step 8 — projects-meta sync (greenfield-full mode)
+
+Only in **greenfield-full** mode. Re-sync the projects-meta cache so the new
+project becomes visible to `mcp__projects-meta__*` tools.
+
+```bash
+# POSIX:
+node ~/projects/.common/lib/projects-meta-mcp/dist/sync.js
+
+# Windows PowerShell:
+node ~/projects/.common/lib/projects-meta-mcp/dist/sync.js
+```
+
+Verify the project is now visible:
+```bash
+# Via MCP (if available in current session):
+# mcp__projects-meta__meta_status
+
+# Or manually check the cache file exists:
+ls -la ~/projects/.common/lib/projects-meta-mcp/cache/projects.json
+```
+
+If the sync script doesn't exist → skip with informational message:
+```
+ℹ️  projects-meta sync script not found at ~/projects/.common/lib/projects-meta-mcp/dist/sync.js
+    Run /setup-projects-meta to install it. The new repo is already created in Gitea.
+```
+
 ---
 
 ## Rules

skills/project-bootstrap/assets/CLAUDE.md.template

@@ -9,4 +9,5 @@ check across all projects
 pull remote before work
 follow project discipline
 delegate to interns when allowed
+recommend, don't menu
 we're on Windows

skills/project-discipline/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: project-discipline
-version: 0.1.0
+version: 0.1.1
 description: >
-  Codifies four cross-project discipline rules: (1) project CLAUDE.md /
+  Codifies five cross-project discipline rules: (1) project CLAUDE.md /
   .wiki/CLAUDE.md / .tasks/ override defaults from any other skill (specs
   go to .wiki/concepts/, not docs/superpowers/specs/; tasks to .tasks/,
   not docs/superpowers/plans/); (2) all work on master/main, no feature
@@ -12,8 +12,10 @@ description: >
   (4) commit freely, never push without explicit per-session user approval
   — grant via "разреши автопуш" / "allow auto-push", revoke via "отзови"
   / "revoke", session end resets to ask-mode; force/delete/non-ff push
-  always asks. Activated by "follow project discipline" trigger in
-  CLAUDE.md (added by project-bootstrap v1.5.0+).
+  always asks; (5) transit-zone / brainstorm workspaces — artifacts
+  go to .brainstorm/ or global wiki only via explicit user direction,
+  never auto-promote by analogy. Activated by "follow project discipline"
+  trigger in CLAUDE.md (added by project-bootstrap v1.5.0+).
 ---
 
 # project-discipline
@@ -107,6 +109,20 @@ A grant covers ordinary fast-forward push to the configured upstream. Anything e
 
 **What counts as "push":** only `git push` family commands. Local commits, `git stash push`, etc. are not push; the grant does not apply.
 
+## Rule 5 — Transit-zone / brainstorm workspaces
+
+Some workspaces are **transit zones** — discussion areas with no `.tasks/`, where brainstorm artifacts are explicitly NOT auto-promoted to project wikis.
+
+**Default destination for brainstorm artifacts:**
+- **In-progress brainstorm outputs** → `.brainstorm/<topic>.md` (or whatever the workspace's README/CLAUDE.md declares)
+- **Mature, cross-cutting outputs** → `~/projects/.wiki/concepts/<topic>-design.md` via `mcp__projects-meta__knowledge_ingest` — **only** when user explicitly directs this
+
+**Agent must NOT auto-promote** brainstorm artifacts to global wikis by analogy with Rule 1. Convergence-moment (move from workspace to permanent wiki) is a user decision, not an automatic action.
+
+**Example:** `~/projects/.meeting-room/` is a transit zone. Its CLAUDE.md explicitly states "no `.tasks/`, transit zone, artifacts go to `.brainstorm/` or global wiki via user command." Rule 1's "project conventions override" applies, but the override is explicit in the workspace contract — auto-promotion by analogy would violate that contract.
+
+**When in doubt:** ask the user "this goes to `.brainstorm/`, or should I promote to shared wiki?" rather than assuming.
+
 ## Out of scope
 
 The skill **does not**:

skills/recommend-dont-menu/README.md

@@ -0,0 +1,32 @@
+# recommend-dont-menu
+
+One recommendation, not a menu. When the user asks "what should we do?", give your best choice with reasoning and trade-offs — don't enumerate A/B/C/D options.
+
+## What it does
+
+Overrides the `superpowers:brainstorming` default of presenting multiple options. Instead, respond with:
+
+```
+Я рекомендую X, потому что Y₁, Y₂. Trade-off: Z. Возражения?
+```
+
+Only mention alternatives when they're genuinely competitive or carry an important trade-off.
+
+## When to use
+
+During design discussions, architecture reviews, brainstorming, or any "what should we do" question.
+
+## Installation
+
+```bash
+bash scripts/install.sh recommend-dont-menu
+```
+
+## Trigger line
+
+Add to `CLAUDE.md`:
+```
+prefer single recommendations
+```
+
+Or use `project-bootstrap` (v1.9.0+) which includes this trigger in its template.

skills/recommend-dont-menu/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: recommend-dont-menu
+version: 0.1.0
+description: >
+  Use during design discussions, brainstorming, architecture reviews, or any
+  "what should we do" question — give one argued recommendation with explicit
+  trade-offs, not a multiple-choice menu. Override of superpowers:brainstorming
+  default. Works on any agent — pure response-style rule, no tool mappings needed.
+---
+
+# recommend-dont-menu
+
+> One recommendation, not a menu. When the user asks "what should we do?" or "which is better?", give your best choice with reasoning and trade-offs. Don't enumerate A/B/C/D options — menus slow down decision-making when one option is clearly better.
+
+## When this runs
+
+**At session start** — when `CLAUDE.md` contains any trigger line:
+- `prefer single recommendations`
+- `recommend, don't menu`
+- `argued recommendations`
+- `give me your best shot`
+
+**On explicit reference** — when user says "give me a recommendation", "don't menu", "what do you think?", or close variants.
+
+## Default mode
+
+For design questions, architecture choices, "what should we do" queries:
+
+```
+Я рекомендую X, потому что Y₁, Y₂. Trade-off: Z. Возражения?
+```
+
+**Only mention alternatives if:**
+- They're genuinely close to the recommended option, OR
+- They carry an important trade-off the user should weigh
+
+Then, briefly:
+```
+Если важно W — лучше X', но добавляет сложность; иначе X.
+```
+
+**Don't enumerate options** for the sake of appearing comprehensive. Menus are noise when one option dominates — they force the user to read through losing choices and bury your reasoning behind an oblique list instead of a responsible recommendation.
+
+## Override
+
+This skill **overrides** `superpowers:brainstorming` where that skill prefers multiple-choice options. User instructions > skill defaults.
+
+If `superpowers:brainstorming` is active in the session, this skill's response style takes precedence for design/brainstorming questions.
+
+## Cross-agent applicability
+
+This skill is **pure response-style** — it works on any agent (Claude, Gemini, Copilot) without tool mappings. No `references/copilot-tools.md` or equivalent needed.
+
+## Why this exists
+
+The pattern emerged from iterative refinement across `claude-skills` brainstorm sessions and `.meeting-room/` discussions. When agents dump 4-option menus for every question, users skim or disengage. A single argued recommendation with clear trade-offs leads to faster convergence and better decisions. When alternatives are genuinely competitive, mention them — but don't manufacture variants.
+
+## Reference
+
+Original rule lived in `~/.claude/CLAUDE.md` as a per-machine instruction. Moving to a skill makes it portable: all machines bootstrapped with `project-bootstrap` inherit it, and cross-agent compatibility is explicit.