Add trade-intelligence skill (draft until MCP tools ship)

[dodeja]

Summary

Adds a second shared skill, trade-intelligence, to the Terminal49 plugin. It answers market questions from US ocean import bill-of-lading records (every US ocean import since 2022, refreshed daily):

• Competitor research: what a named company imports, including volume and trend against a year earlier, origin countries, US ports and destination states, carriers, and products.
• Sourcing: who imports a product, and where it comes from (countries, lanes, ports).
• Market trends by port, coast, carrier, origin, or commodity, with period-over-period comparisons over full months.

The skill also tells the agent which caveats change an answer. Forwarders and brokers appear on the records. One company can show up under several names. Some importers withhold their names. The latest month is often partial, and values are estimates.

How it authenticates today

The skill calls the Terminal49 REST API through a bundled client, scripts/ti.py, which needs only Python 3 with no extra dependencies. The client reads the user's Terminal49 API key from T49_API_KEY or ~/.t49_api_key. The user saves the key in their own terminal with a one-liner that works in bash and zsh. The skill follows the same credential rules as container-tracking: it never asks for a key in chat and never prints one. Trade intelligence is enabled per account. Accounts without it get HTTP 403, and the skill tells the user to contact support@terminal49.com instead of retrying.

Why this is a draft

Terminal49 MCP tools for trade intelligence are planned. When they ship, this skill will switch to them, so it authenticates through the same OAuth MCP connection as container-tracking and no longer needs a local API key or the Python client. This PR stays a draft until then.

Evaluation

The source skill went through two rounds of evaluation, comparing the skill against no skill on the same API. With the skill, the agent passed 24 of 25 checks; without it, 20 of 25. This PR adapts that skill to the repo's conventions without changing its guidance. The eval suite is not included here.

Changes

• plugins/terminal49/skills/trade-intelligence/: SKILL.md, references/api.md, and scripts/ti.py. The skill name matches its folder. The setup wording follows the container-tracking credential rules, and the key-save command works in both bash and zsh.
• scripts/validate.mjs now checks every skill directory:
  • each skill has frontmatter, a name that matches its folder, and a description
  • every references/… and scripts/… file a skill mentions exists
  • the trade-intelligence skill forbids pasting keys into chat and sends accounts without access to support@terminal49.com
• Version bumped to 0.2.0 in all three plugin manifests and both versioned marketplace files, following the release rule in AGENTS.md. The shared descriptions and keywords mention trade intelligence, and Codex's interface copy gets a matching default prompt.
• README.md, plugins/terminal49/README.md, AGENTS.md, and CONTRIBUTING.md list both skills and document the API-key setup.

Validation

• npm run validate passes. A mutated copy of the repo fails with the expected errors when the skill name is wrong, references/api.md or scripts/ti.py is missing, or the guardrail text is removed.
• claude plugin validate plugins/terminal49 and claude plugin validate . both pass.
• The key-save command was run in bash and zsh. It writes the key without a trailing newline and leaves the file at mode 600, including when it overwrites an existing world-readable file.
• The ti.py error paths were checked: bad JSON, an unreachable host, and --help.
• Codex (gpt-6-sol) reviewed the diff and found two issues, both fixed here: the validator missed the backticked scripts/ti.py command, and the key-save command could keep loose permissions on an existing key file.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T05:03:37.469589Z	457ccaf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 457ccafc28

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add native Windows credential setup

When the plugin runs under native Windows/PowerShell, the prescribed no-key recovery cannot work because read -rs, umask, chmod, and unset are Bash/Zsh syntax. Since this skill is shared by every supported client, Windows users who follow its instructions cannot configure the new feature without independently discovering a different secure setup; provide an OS-appropriate command or make the client handle credential storage portably.

AGENTS.md reference: AGENTS.md:L1-L3

Useful? React with 👍 / 👎.