microsoft
diff --git a/‎.gitignore‎
Lines changed: 3 additions & 0 deletions b/‎.gitignore‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎AGENTS.md‎
Lines changed: 8 additions & 0 deletions b/‎AGENTS.md‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 4 additions & 0 deletions b/‎README.md‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎plugins/power-pages/AGENTS.md‎
Lines changed: 16 additions & 5 deletions b/‎plugins/power-pages/AGENTS.md‎
Lines changed: 16 additions & 5 deletions
diff --git a/‎plugins/power-pages/PLUGIN_DEVELOPMENT_GUIDE.md‎
Lines changed: 2 additions & 2 deletions b/‎plugins/power-pages/PLUGIN_DEVELOPMENT_GUIDE.md‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎plugins/power-pages/README.md‎
Lines changed: 33 additions & 1 deletion b/‎plugins/power-pages/README.md‎
Lines changed: 33 additions & 1 deletion
diff --git a/‎plugins/power-pages/hooks/hooks.json‎
Lines changed: 23 additions & 0 deletions b/‎plugins/power-pages/hooks/hooks.json‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎plugins/power-pages/hooks/run-skill-posttool-validation.js‎
Lines changed: 21 additions & 26 deletions b/‎plugins/power-pages/hooks/run-skill-posttool-validation.js‎
Lines changed: 21 additions & 26 deletions
@@ -48,3 +48,6 @@ ENV/
 Thumbs.db
 
 .playwright-mcp/
+
+# oh-my-claudecode scratch state
+.omc/
@@ -63,6 +63,14 @@ Skills that apply to all plugins live in `shared/skills/<skill-name>/`. The work
 
 This keeps the skill discoverable in each plugin while preserving install-time portability. Marketplace installs copy only the plugin directory, so per-plugin wrappers must not reference repo-root `shared/` paths at runtime. Instead, point the wrapper at `${CLAUDE_PLUGIN_ROOT}/skills/<skill-name>/<workflow>.md` and keep a symlink from that per-plugin path to the repo-root shared workflow; marketplace installers dereference same-marketplace symlinks into the installed plugin cache. When updating a shared skill, edit the workflow file and/or `SKILL.template.md` in `shared/`, then update the per-plugin wrappers (frontmatter + bundled workflow reference, with `{{PLUGIN_NAME}}` substituted) and ensure any per-plugin symlinks still resolve under `plugins/<plugin>/skills/<skill-name>/`. Commit the shared source and per-plugin symlinks together.
 
+## Shared Telemetry
+
+1DS telemetry code for all plugins lives at `shared/telemetry/`. Each adopting plugin **symlinks** the library into its own tree — `plugins/<plugin>/scripts/lib/telemetry/lib` is a symlink to `shared/telemetry/lib`. The marketplace installer dereferences that symlink into the installed plugin at install time, so the shared code ships without copying it into each plugin. Each plugin keeps its own real `ikey.json` next to the symlink.
+
+Edit `shared/telemetry/` directly — the symlink makes changes live for every adopting plugin immediately; there is nothing to re-sync.
+
+Current adopters: `power-pages`. Others adopt on demand.
+
 ## Code Conventions
 
 **DRY (Don't Repeat Yourself):** Never duplicate logic across files. Each plugin has shared utilities (e.g., `scripts/lib/`) and shared reference docs (e.g., `references/`). Always check for and reuse existing helpers before writing new code. When adding shared logic, put it in the plugin's shared modules — not in individual skill directories.
 
@@ -211,3 +211,7 @@ trademarks or logos is subject to and must follow
 [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/legal/intellectualproperty/trademarks/usage/general).
 Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship.
 Any use of third-party trademarks or logos are subject to those third-party's policies.
+
+## Telemetry
+
+Plugins that ship 1DS telemetry (currently: `power-pages`) gather anonymous usage signals. Telemetry is default-on; users opt out per-plugin via the `/<plugin>:telemetry off` command (e.g. `/power-pages:telemetry off`), stored in `~/.power-platform-skills/config.json`. See `shared/telemetry/README.md` for what is sent.
@@ -153,15 +153,15 @@ Skills are defined in `SKILL.md` files with YAML frontmatter (name, description,
 
 ### Hooks
 
-Hook registration is centralized in `hooks/hooks.json` — a single PostToolUse hook (matcher `Skill`) runs `hooks/run-skill-posttool-validation.js` after every Skill tool call. The runner consults the `TRACKED_SKILLS` map in `scripts/lib/powerpages-hook-utils.js`, looks up the validator for the skill that just completed, and invokes it with the current cwd.
+Hook registration is centralized in `hooks/hooks.json` — a single PostToolUse hook (matcher `Skill`) runs `hooks/run-skill-posttool-validation.js` after every Skill tool call. The runner derives tracked skills directly from `skills/*/SKILL.md` via `scripts/lib/powerpages-hook-utils.js`, looks up an optional `skills/<skill>/scripts/validate*.js` validator for the skill that just completed, and invokes it with the current cwd.
 
 To wire a new skill into validation:
 
 1. Write the validator at `skills/<skill>/scripts/validate-<skill>.js` using the `runValidation((cwd) => { ... })` pattern from `scripts/lib/validation-helpers.js`.
-2. Register the skill in `TRACKED_SKILLS` (in `scripts/lib/powerpages-hook-utils.js`) with its `validatorScript` path.
-3. Add test coverage in `scripts/tests/powerpages-hook-utils.test.js` so an unregistered skill is caught in CI.
+2. No manual tracked-skill registration is needed. Any folder with `skills/<skill>/SKILL.md` is automatically tracked for telemetry and hook detection.
+3. Add or update test coverage in `scripts/tests/powerpages-hook-utils.test.js` if you introduce a new validator naming pattern.
 
-Skills currently registered with command-backed validators: `activate-site`, `add-cloud-flow`, `add-seo`, `add-server-logic`, `audit-permissions`, `configure-env-variables`, `create-site`, `create-webroles`, `deploy-pipeline`, `ensure-pipelines-host`, `export-solution`, `force-link-environment`, `import-solution`, `integrate-webapi`, `plan-alm`, `setup-auth`, `setup-datamodel`, `setup-pipeline`, `setup-solution`. `add-sample-data` and `test-site` are tracked without command validators (no artifacts to verify). `diagnose-deployment` is intentionally not tracked — it's read-only and produces no artifacts to verify.
+All skill folders are tracked. Skills without a `scripts/validate*.js` file are tracked for telemetry/detection but skip validation.
 
 **Anti-patterns** (see `PLUGIN_DEVELOPMENT_GUIDE.md` for the rationale): do not add `hooks: Stop:` blocks to individual SKILL.md frontmatter — they duplicate the centralized PostToolUse hook and fire too often. Do not use `type: prompt` Stop hooks for skill-completion checks — they create runaway forced-continuation loops.
 
@@ -342,7 +342,7 @@ This runs a lightweight check comparing the local plugin version against `origin
 
 - **Approval Gates** — Every load-bearing `AskUserQuestion` is an **Approval Gate**. Pause at minimum after gathering requirements, after presenting a plan, after implementation, and before deployment (Three-Point Approval Pattern). For ALM skills, every gate must (a) be catalogued in `references/approval-gates.md` §6 with a stable `gate-id`, and (b) be marked in SKILL.md with the explicit-pairing comment `<!-- gate: skill:phase | category=<intent|plan|progress|consent|final|pause> | cancel-leaves=<vocab> -->` followed by a human-readable `> 🚦 **Gate (...)**` block. New ALM skills must extend the catalog in the same PR that introduces the skill. Non-ALM skills should follow the same convention as the catalog is extended in a follow-up; lint runs warn-only on non-ALM skills until then. Do not coin alternative terms ("review gate", "approval checkpoint", "manual step" etc.) — the canonical term is **Approval Gate**.
 - **Deployment prompt** — Skills that modify site artifacts should end by asking "Ready to deploy?" and invoke `/deploy-site` if yes.
-- **Lifecycle hooks** — If a skill needs command validation or checklist enforcement, update `hooks/hooks.json` and `scripts/lib/powerpages-hook-utils.js`. Do not define hook registration in individual `SKILL.md` files.
+- **Lifecycle hooks** — Hook registration is centralized in `hooks/hooks.json`; `scripts/lib/powerpages-hook-utils.js` derives tracked skills from `skills/*/SKILL.md` and discovers optional `scripts/validate*.js` validators. Do not define hook registration in individual `SKILL.md` files.
 - **Graceful failure** — Track API call results, never auto-rollback, report failures clearly, continue with remaining items.
 - **Token refresh** — Refresh Azure CLI token every ~20 records / 3-4 tables / ~60 seconds.
 - **Git commits** — Commit after every significant milestone (each page/component, design foundations, phase completion).
@@ -388,6 +388,17 @@ These patterns have caused repeated PR review feedback. Check for them before su
 - **Template placeholders in `<script>` blocks need special care** — `render-template.js` injects string values as-is (no encoding), which is safe for HTML text contexts but risky inside JavaScript. Avoid declaring JS variables with `"__PLACEHOLDER__"` in script blocks; prefer reading from the DOM or using `JSON.stringify` for JS contexts.
 - **Guidance must be consistent within a skill** — If one section says "always use raw fetch", a framework-specific table in the same file must not recommend a different HTTP client without qualification. Reviewers will flag contradictions.
 
+## Telemetry
+
+This plugin ships 1DS telemetry for skill-run and script-run signals. The shared library lives at the repo-root `shared/telemetry/`; `scripts/lib/telemetry/lib` is a **symlink** to `shared/telemetry/lib`, so the shared code is the live code. Zero npm dependencies — nothing to install.
+
+- **`scripts/lib/telemetry/lib` is a symlink** to the repo-root `shared/telemetry/lib` — edit `shared/telemetry/lib/` directly; there is no copy to re-sync. The one real file under `scripts/lib/telemetry/` is `ikey.json` (this plugin's config). **Posture:** the committed `ikey.json` ships `disabled: true`; a working-tree `disabled: false` is a local experiment only — never commit it.
+- **Privacy posture:** anonymous telemetry is **default-on**. There is no consent prompt in skills. Users opt out via `/power-pages:telemetry off`, which stores a per-plugin choice in `~/.power-platform-skills/config.json` (`telemetry["power-pages"] = "off"`). Opting out stops transmission only; the local diagnostic mirror is still written. Re-enable with `/power-pages:telemetry on`.
+- **Strict allowlist:** `shared/telemetry/lib/events.js` enforces exactly the fields listed in the spec. Never add a field to a builder without first adding it to the allowlist and documenting it in the design doc.
+- **Fail closed:** telemetry code must never change a script's exit code or break a skill run. Emission is fire-and-forget via a detached dispatcher child, so the hook or script returns before the HTTPS POST completes.
+
+See `shared/telemetry/README.md` for the integration guide.
+
 ## Maintaining This File
 
 Update when plugin structure or conventions change or you learn something which can be useful for new skills or agents.
 
@@ -197,7 +197,7 @@ LLMs are probabilistic. When an LLM constructs inline bash commands for Datavers
 |--------|---------|
 | `validation-helpers.js` | `runValidation()`, `findPath()`, `findProjectRoot()`, `approve()`, `block()` — shared boilerplate for all validators |
 | `powerpages-config.js` | Loads `.powerpages-site` YAML files (table permissions, site settings, web roles) with consistent parsing |
-| `powerpages-hook-utils.js` | Maps skill names to validator scripts for the hook dispatcher |
+| `powerpages-hook-utils.js` | Discovers skill folders and optional validator scripts for the hook dispatcher |
 | `powerpages-schema-validator.js` | Validates permission/site-setting YAML schema |
 | `table-permissions-validator.js` | Validates table permission YAML |
 | `web-roles-validator.js` | Validates web role YAML |
@@ -410,7 +410,7 @@ echo '{"reason":"ni-dev — ALM handled by infra"}' > .alm-deferred
 
 PostToolUse on the `Skill` tool fires **once per skill invocation**. Stop fires on **every assistant pause** (including user-input waits — every "Continue?" prompt fires it).
 
-This plugin uses PostToolUse via `hooks/hooks.json` → `run-skill-posttool-validation.js` → per-skill validator. Skill frontmatter must NOT declare its own `hooks: Stop:` block — those duplicate the centralized PostToolUse hook and fire too often. To wire validation for a new skill, register it in the `TRACKED_SKILLS` map in `scripts/lib/powerpages-hook-utils.js` (see `AGENTS.md` → "Hooks" for the registration steps).
+This plugin uses PostToolUse via `hooks/hooks.json` → `run-skill-posttool-validation.js` → per-skill validator. Skill frontmatter must NOT declare its own `hooks: Stop:` block — those duplicate the centralized PostToolUse hook and fire too often. `scripts/lib/powerpages-hook-utils.js` automatically tracks every `skills/*/SKILL.md` folder and discovers an optional `skills/<skill>/scripts/validate*.js` validator, so new skills do not need manual hook registration.
 
 #### 4. Skills write explicit status, not just artifact presence
 
 
@@ -38,7 +38,7 @@ This keeps hook behavior in one place and avoids relying on skill-frontmatter ho
 
 ## Skills
 
-The plugin provides 29 skills that cover the full lifecycle of a Power Pages code site — scaffolding, deployment, data modeling, backend integration, authentication, ALM and CI/CD, security review, testing, and auditing. Each skill is invoked conversationally — just describe what you want to do.
+The plugin provides 30 skills that cover the full lifecycle of a Power Pages code site — scaffolding, deployment, data modeling, backend integration, authentication, ALM and CI/CD, security review, testing, and auditing. Each skill is invoked conversationally — just describe what you want to do.
 
 ### Site scaffolding and deployment
 
@@ -373,6 +373,17 @@ Collects context about the current session and opens a pre-filled GitHub issue a
 - Attaches relevant file paths and environment info
 - Opens the issue in your browser for final review
 
+#### `/telemetry`
+
+> "Turn off telemetry" · "Disable telemetry" · "Telemetry status"
+
+Enables, disables, or checks the status of anonymous usage telemetry. Per-user and per-plugin; the choice is stored in `~/.power-platform-skills/config.json`. See [Telemetry & privacy](#telemetry--privacy) below.
+
+- `/power-pages:telemetry status` — show the current setting
+- `/power-pages:telemetry off` — stop sending telemetry (nothing leaves your machine)
+- `/power-pages:telemetry on` — resume sending telemetry
+- No personal data is ever collected (anonymous: skill name, plugin version, OS, Node version)
+
 ## Agents
 
 The plugin includes 4 specialized agents that are spawned automatically by skills when needed:
@@ -476,6 +487,27 @@ node plugins/power-pages/scripts/validate-permissions-schema.js --projectRoot /p
 
 This Dataverse relationship check is intended for local validation only and should not be used in CI.
 
+## Telemetry & privacy
+
+This plugin sends **anonymous** usage telemetry by default to help Microsoft
+improve it. **No personal data is ever collected** — only things like skill name,
+plugin version, OS, and Node version. It never includes file paths, prompts, tool
+inputs, site names, URLs, credentials, usernames, or hostnames.
+
+**Turn it on or off (per-user, applies to every project):**
+
+```bash
+/power-pages:telemetry status   # show the current setting
+/power-pages:telemetry off      # stop sending telemetry
+/power-pages:telemetry on       # resume sending telemetry
+```
+
+When **off**, nothing leaves your machine. A local diagnostic copy of each event
+is still written to `~/.power-platform-skills/events.jsonl` so you can see exactly
+what would have been sent; delete it anytime. The setting is stored at
+`~/.power-platform-skills/config.json` (`{ "telemetry": { "power-pages": "off" } }`),
+so CI/headless environments can opt out by writing that file directly.
+
 ## License
 
 [MIT](../../LICENSE)
@@ -1,5 +1,17 @@
 {
   "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run-skill-pretool-telemetry.js\"",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Skill",
@@ -11,6 +23,17 @@
           }
         ]
       }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run-user-prompt-telemetry.js\"",
+            "timeout": 30
+          }
+        ]
+      }
     ]
   }
 }
@@ -23,41 +23,36 @@ process.stdin.on('data', (chunk) => {
 
 process.stdin.on('end', () => {
   debug(`[power-pages hook] stdin closed, received ${inputData.length} bytes\n`);
+
+  let validatorStatus = 0;
+  let skillName = null;
+  let input = null;
+
   try {
-    const input = JSON.parse(inputData);
-    const skillName = getTrackedSkillFromToolInput(input.tool_input);
+    input = JSON.parse(inputData);
+    skillName = getTrackedSkillFromToolInput(input.tool_input);
     if (!skillName) {
       debug('[power-pages hook] No tracked skill detected — skipping validation\n');
       process.exit(0);
     }
 
     const validatorScript = getValidatorScript(skillName);
-    if (!validatorScript) {
-      debug(`[power-pages hook] Skill "${skillName}" has no validator — skipping\n`);
-      process.exit(0);
+    if (validatorScript) {
+      const validatorPath = path.join(__dirname, '..', validatorScript);
+      const result = spawnSync(process.execPath, [validatorPath], {
+        input: inputData,
+        encoding: 'utf8',
+        cwd: input.cwd || process.cwd(),
+      });
+      if (result.stdout) process.stdout.write(result.stdout);
+      if (result.stderr) process.stderr.write(result.stderr);
+      validatorStatus = result.status ?? 0;
+      debug(`[power-pages hook] Validator exited with code ${validatorStatus}\n`);
     }
-
-    debug(`[power-pages hook] Running validator for skill "${skillName}": ${validatorScript}\n`);
-
-    const validatorPath = path.join(__dirname, '..', validatorScript);
-    const result = spawnSync(process.execPath, [validatorPath], {
-      input: inputData,
-      encoding: 'utf8',
-      cwd: input.cwd || process.cwd(),
-    });
-
-    if (result.stdout) {
-      process.stdout.write(result.stdout);
-    }
-
-    if (result.stderr) {
-      process.stderr.write(result.stderr);
-    }
-
-    debug(`[power-pages hook] Validator exited with code ${result.status ?? 0}\n`);
-    process.exit(result.status ?? 0);
   } catch (err) {
     process.stderr.write(`[power-pages hook] Unexpected error: ${err.message}\n`);
-    process.exit(0);
+    validatorStatus = 0;
   }
+
+  process.exit(validatorStatus);
 });
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,17 @@`
`1`	`1`	`{`
`2`	`2`	`"hooks": {`
	`3`	`+ "PreToolUse": [`
	`4`	`+ {`
	`5`	`+ "matcher": "Skill",`
	`6`	`+ "hooks": [`
	`7`	`+ {`
	`8`	`+ "type": "command",`
	`9`	`+ "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run-skill-pretool-telemetry.js\"",`
	`10`	`+ "timeout": 30`
	`11`	`+ }`
	`12`	`+ ]`
	`13`	`+ }`
	`14`	`+ ],`
`3`	`15`	`"PostToolUse": [`
`4`	`16`	`{`
`5`	`17`	`"matcher": "Skill",`
`@@ -11,6 +23,17 @@`
`11`	`23`	`}`
`12`	`24`	`]`
`13`	`25`	`}`
	`26`	`+ ],`
	`27`	`+ "UserPromptSubmit": [`
	`28`	`+ {`
	`29`	`+ "hooks": [`
	`30`	`+ {`
	`31`	`+ "type": "command",`
	`32`	`+ "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run-user-prompt-telemetry.js\"",`
	`33`	`+ "timeout": 30`
	`34`	`+ }`
	`35`	`+ ]`
	`36`	`+ }`
`14`	`37`	`]`
`15`	`38`	`}`
`16`	`39`	`}`