The install section documented `--function-hook` as available, but the flag
was only ever merged to main - it is not in the published 1.29.4 on npm, so
`npx claude-code-templates@latest --function-hook ...` failed with
"unknown option". Bump to 1.29.5 so the flag ships, state the minimum
version in the article, and add the manual plugin layout as a fallback.
Also correct claims that testing on Claude Code 2.1.266 contradicted or
that the binary now answers outright:
- The runtime is compiled in. Document the real $ surface found in the
binary (fs/http/process/model/store/session/ui/tool/agent/command/prompt),
the classic.* event namespace and engine.create withholding, replacing
the "what if the flag does nothing" box.
- Soften the <name>@skills-dir auto-load claim; it is unverified. Recommend
--plugin-dir, which is the path actually tested.
- Note secret-redactor's two real limits: shape-only matching (PASSWORD=
hunter2 passes) and a connection-string pattern that stops at the @, so
host, port and database name survive redaction.
- Note that $.ui.log appears TUI-only and is silent under `claude -p`;
universal-audit-log is unaffected since it writes via $.fs.append.
- Hang budget: the binary has reentrancy detection and per-plugin model
budgets, so answer the part that is now known and keep the rest open.
Claude-Session: https://claude.ai/code/session_01KnCWDj7sV9JznrV5UMNy8W
* improve: enhance architecture-modernizer agent based on automated review
- Add required `model: sonnet` field (was missing, would fail component review)
- Add `Glob` to tools list for consistency with sibling agents and to
support file/module enumeration during service-boundary analysis
- Add closing "Integration with Other Agents" hand-off section reciprocating
legacy-modernizer's existing reference to this agent
- Add concrete tool-usage guidance (Grep/Glob for module/coupling
inventory, Bash for dependency-graph tooling, Write for ADRs/diagrams)
- Strengthen the closing risk/rollback guidance with named techniques
(contract tests, shadow traffic, feature flags, canary rollout, legacy
decommissioning, shared-database coupling)
- Add tactical DDD context-mapping detail to the Approach section
- Tie Output bullets to concrete artifact formats (ADRs, Mermaid, OpenAPI/AsyncAPI)
Automated review cycle
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRgMrRbDvzACuMDfhSHKnE
* fix: make ADR output location adapt to target repo convention
Address Greptile review feedback on PR #874: hardcoding docs/architecture/
ignores a target repo's existing ADR convention (e.g. docs/adr/,
docs/decisions/), creating a second decision-record hierarchy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRgMrRbDvzACuMDfhSHKnE
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance data-engineer agent based on automated review
- Fix model field: claude-sonnet-4-5 -> sonnet (repo-wide convention)
- Add WebSearch tool for fast-moving tooling/pricing landscape
- Add explicit agent-boundary/hand-off language (database-architect,
ai-engineer, ml-engineer, database-optimizer)
- Rewrite data engineering checklist to replace absolutist claims with
negotiated, validated criteria
- Add Iceberg REST catalog layer (Apache Polaris, Unity Catalog OSS,
AWS Glue/S3 Tables) and real-time OLAP serving tools (ClickHouse,
StarRocks, Apache Pinot/Druid)
- Densify thin sections (pipeline architecture, stream processing, data
modeling, cost optimization, governance) with named tools
- Add DuckDB/MotherDuck, reverse ETL (Hightouch/Census), and
warehouse-native vector search alternatives
Automated review cycle
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
* fix: separate data-loss tolerance from delivery semantics in checklist
Greptile review flagged that the checklist conflated data-loss tolerance
with exactly-once vs. at-least-once delivery semantics. These are
distinct: at-least-once delivery can still guarantee zero loss via
dedup, and exactly-once processing can still lose data if source
retention expires before replay.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
* fix: scope Iceberg REST catalog clause to Iceberg only
cubic review flagged that the table-formats bullet implied the Iceberg
REST catalog applies to Delta Lake and Hudi too. Delta Lake and Hudi
have their own metadata/catalog mechanisms, so the clause is now
qualified to Iceberg specifically.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
* fix: avoid contradicting zero-loss-is-not-a-guarantee framing
cubic review flagged that "can still guarantee zero loss" contradicts
the checklist's own instruction two lines above not to claim zero loss
as a guarantee. Reworded to "can still achieve zero loss when replay
and idempotent/deduplicated writes are available."
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat: add worktree-context-statusline setting
Minimal worktree-aware status line: project | branch | model | context.
Shows the main project name (not the worktree dir) inside linked
worktrees, marks the branch with ⑂, and reads accurate context usage
from Claude Code's context_window (200k or 1M) instead of guessing.
Regenerates the component catalog.
Claude-Session: https://claude.ai/code/session_01QHCvqCvD9JD9J6ZeAK8NS7
* fix(cli): make statusline script paths scope-aware
- Detect the companion .py from the statusLine command, not only the statusline/ name prefix
- For user/enterprise installs, rewrite .claude/scripts/ in the command to the absolute scripts dir where the file is actually written
Claude-Session: https://claude.ai/code/session_01WsWgpvgeJgRMoLiYDcRXMU
* feat: add Function Hooks component type (experimental) with 10 hooks and blog
Introduce "function-hooks" as a new first-class component type based on
the Anthropic proposal in anthropics/claude-code#91870 (TypeScript hooks
as Koa-style middleware on a $ engine interface). The feature is not
shipped; every API name is provisional and the section is labelled
experimental everywhere.
- 10 function hooks under cli-tool/components/function-hooks/
(security, productivity, observability, ui, integrations, enterprise),
each as a .md doc page plus the installable .ts/.tsx hooks-module
- CLI: --function-hook installs the module as a local plugin under
.claude/plugins/<name>/ (plugin.json, hooks/hooks.json with modules)
and prints the experimental warning
- Catalog generator: scan function-hooks and emit dashboard artifacts
- Dashboard: type wiring, /function-hooks page with experimental banner
linking to the issue, Events/Module cards on the detail page,
sitemap, cart, webmcp; track-download now accepts loop/function-hook
- Blog: "Claude Code Function Hooks (Experimental)" article with cover
- Docs: CLAUDE.md and cli-tool rule
Claude-Session: https://claude.ai/code/session_01YBoJbmNMcRCexuKpH9mQtW
* fix: store function hooks as hooks.json + module, install as skills-dir plugin
Function hooks are not markdown docs. Per the proposal's architecture doc,
a function hook is a plugin's hooks/hooks.json with a "modules" key naming
a .ts/.tsx hooks-module beside it. Align the catalog and the CLI with that:
- Components are now {name}.json (hooks.json + catalog description) plus
the {name}.ts/.tsx module it names, mirroring how shell hooks store
.json + .py/.sh. The .md docs are removed.
- Generator reads the named module into the per-component content file
(module, moduleSource); the detail page renders the JSON and the module
with the experimental notice.
- CLI --function-hook downloads hooks.json and every module it names,
strips description, and writes the plugin to .claude/skills/{name}/,
which Claude Code auto-loads as {name}@skills-dir per the plugins
reference (no --plugin-dir needed).
- Docs and blog updated to the same install path.
Claude-Session: https://claude.ai/code/session_01YBoJbmNMcRCexuKpH9mQtW
* fix(function-hooks): address review findings
- CartSidebar: add --loop and --function-hook to TYPE_FLAGS so stack commands install them
- SendToRepoModal: export loops and function hooks (plugin layout with hooks.json + module)
- CLI: validate function hook identifier and hooks-module file names before building URLs/paths
- block-destructive-commands: rm rule now catches split flags, --recursive, quoted/trailing-slash targets, --no-preserve-root
- admin-capability-lockdown: shellPolicy deny|guardrail|allow; default withholds Bash, guardrail is labelled bypassable
- regenerate catalog
Claude-Session: https://claude.ai/code/session_01WsWgpvgeJgRMoLiYDcRXMU
* improve: enhance documentation-expert based on automated review
- Soften "accuracy" checklist claim from execution-implying language to manual verification (agent has no Bash tool)
- Note overlap with technical-writer in Limitations, recommending using whichever is already installed
- Add accessibility checklist item and alt-text output guidance
- Reference llms.txt/AEO conventions and defer to llms-maintainer for llms.txt maintenance
- Operationalize "Docs as Code" with concrete linting tools and PR-review workflow
- Specify readability metric precisely as Flesch Reading Ease score
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SviPdqjmxanA9U4HEcuYvc
* fix: clarify AEO wording and sync generated dashboard content
- Reword "llms.txt/AEO conventions" to avoid ambiguity: this catalog
already uses "AEO" for two different meanings (AI Engine Optimization
in llms-maintainer vs Answer Engine Optimization in
search-ai-optimization-expert). Now spells out llms.txt's purpose
directly instead of relying on the overloaded acronym.
- Regenerate dashboard/public/component-content/agents/expert-advisors/documentation-expert.json
so the published detail page matches the updated agent body.
Addresses review-bot findings from cubic/greptile on PR #868.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SviPdqjmxanA9U4HEcuYvc
* fix: clarify Docs as Code linting is a CI recommendation, not agent-executed
The "Docs as Code in practice" bullet told the agent to "lint prose
with tools like Vale or alex" as if it could run them, but the agent
has no Bash tool — contradicting this PR's own rationale for softening
the accuracy checklist item. Reworded to make clear these are CI
checks the project runs, not something the agent executes itself.
Addresses cubic-dev-ai review finding on PR #868.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SviPdqjmxanA9U4HEcuYvc
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-performance-optimizer based on automated review
- Add graphql-jit query execution compilation strategy (hot operations, ~10x throughput, tradeoffs)
- Add totalCount/expensive aggregate field guidance for connection pagination
- Document client-side APQ retry flow (createPersistedQueryLink)
- Add caution note on HTTP batching vs horizontal load balancing
- Reference graphql-armor as consolidated production default alongside manual complexity wiring
- Mention max-aliases as complementary resource-exhaustion mitigation
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1RaEFP8KGektShfzukd4R
* fix: address review findings in graphql-jit example
- Key the compiled-query cache by operationName + query, since a document
can define multiple named operations that each compile to a distinct
function (previously the first-requested operation's compilation was
reused for all others in the same document).
- Replace the unbounded Map with a bounded LRUCache so a public API can't
be driven into unbounded compilation/memory growth by unique queries.
- Catch parse() errors and return them as a GraphQL error response instead
of letting them throw past the documented fallback.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1RaEFP8KGektShfzukd4R
* fix: clarify graphql-jit example's allowlist gate and cache-bound claims
- The comment claimed the snippet gates compilation behind an allowlist,
but the code compiles whatever query it receives. Reword to say the
snippet doesn't enforce that gate itself and that production use should
add it.
- The tradeoffs sentence attributed "unbounded cache growth" to an
unbounded allowlist, but the LRUCache above already bounds cache size
by entry count regardless. Reword to attribute the unbounded cost to
per-query compile CPU, not cache growth.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1RaEFP8KGektShfzukd4R
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add OrcaReplay MCP component
Six stdio tools that let Claude Code read, explain and replay its own recorded runs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Disclose Node.js 20+ requirement in the component description
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* improve: enhance shopify-expert based on automated review
- Fix incorrect metafield type identifiers (single_line_text/multi_line_text -> single_line_text_field/multi_line_text_field, plus fill out the full type list)
- Add mandatory GDPR compliance webhooks (customers/data_request, customers/redact, shop/redact) to App Development guidance
- Flag the Legacy -> New Customer Accounts (OAuth 2.0/PKCE) transition in Common Scenarios and Theme File Structure
- Replace placeholder comments in the App Proxy example with real HMAC-SHA256 signature verification
- Add closing "Integration with Other Agents" and "Security Checklist" sections matching sibling agents in api-graphql/
- Note Rust as the higher-performance option for Shopify Functions, and add Billing API/B2B/Markets/Agentic Commerce coverage
Automated review cycle | Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JHpvzjn2H6xueDeHdga7ry
* fix: guard against uneven-length signature in App Proxy HMAC check
crypto.timingSafeEqual throws when its two buffers differ in length,
so a malformed (wrong-length) signature would raise an unhandled
exception instead of falling through to the intended unauthorized
response. Add a byte-length equality check before the comparison.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JHpvzjn2H6xueDeHdga7ry
* fix: separate GDPR webhook ack deadline from data-deletion deadline
The five-second HTTP acknowledgement deadline for Shopify compliance
webhooks was conflated with the 30-day deadline for completing the
underlying data request or deletion. State both separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JHpvzjn2H6xueDeHdga7ry
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-performance-optimizer agent based on automated review
- Broaden tools frontmatter to Read, Grep, Glob, Edit, Write, Bash (matches sibling agents; adds Edit for surgical resolver rewrites and Glob for file discovery)
- Add closing "Integration with other agents" section declaring delegation to graphql-architect, graphql-security-specialist, database-optimizer, backend-developer, frontend-developer
- Document OpenTelemetry GraphQL instrumentation as the recommended production monitoring approach, alongside the existing lightweight console.warn plugin
- Document Apollo Federation Demand Control (@cost/@listSize directives) in the Federation Performance section
- Replace artillery/autocannon load testing example with k6 (native GraphQL/WebSocket support), keeping artillery/autocannon as a note for simpler CI smoke tests
- Add a brief Client-Side Considerations section covering Apollo Client BatchHttpLink and Relay store GC tuning
Automated review cycle | Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhCvfh3VHh4nFcBy2Ft1fe
* fix: address bot review findings in graphql-performance-optimizer
- Fix invalid Federation demand-control SDL: add missing @link import
and use an int (not string) @cost weight; bump to federation/v2.12
to match the currently-supported LTS line per graphql-architect.md
- Correct OpenTelemetry section to stop claiming automatic DataLoader
batch-size instrumentation; add the manual span pattern actually
needed to get that signal
- Fix k6 load-test script to actually exercise both weighted queries
(previous version always sent queries[0]) and pass required
GraphQL variables for the parameterized query
- Guard the k6 error check against non-JSON error responses instead
of letting JSON.parse crash the check
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhCvfh3VHh4nFcBy2Ft1fe
* fix: randomize k6 GetUserDetails id per iteration
The hardcoded id: '1' meant the weighted query always exercised the
same row, skewing the load test's p95/error-rate thresholds via
per-row caching. Generate a distributed id per iteration instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhCvfh3VHh4nFcBy2Ft1fe
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance ad-security-reviewer agent based on automated review
- Restrict tools to Read, Grep, Glob (removed Write/Edit/Bash) to match
the review-only nature of an auditor agent; document handoff of
remediation to powershell-security-hardening/windows-infra-admin
- Add AD CS / certificate-services abuse coverage (ESC1, ESC4, ESC6/7,
ESC8, full ESC1-16 via Certipy)
- Add Assessment Tooling section naming BloodHound, PingCastle, ADRecon,
Certipy/Certify as evidence sources
- Add a numbered "When Invoked" workflow and a concrete Markdown report
format with a severity table
- Expand attack-technique coverage: AS-REP roasting, Golden/Silver
tickets, NTLM-relay coercion (PetitPotam/PrinterBug), noPac,
Zerologon, Shadow Credentials, GPP cpassword, SID-history abuse, RBCD
- Anchor methodology to Microsoft's Enterprise Access Model (Tier 0/1/2)
and CIS Benchmarks
- Sharpen Kerberoasting/service-account remediation: gMSA migration,
AES-only Kerberos, disable RC4
- Add model: sonnet to frontmatter for consistency with sibling agents
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address Greptile review findings on ad-security-reviewer
- Replace inaccurate "Tier 0/1/2" labeling of the Microsoft Enterprise
Access Model with its actual Control Plane/Management Plane/
Data-Workload Plane terminology, noting the legacy Tier 0/1/2 model
is informally equivalent rather than identically named.
- Soften the unconditional "require AES-only Kerberos, disable RC4 for
all service accounts and trusts" guidance into an audit-first
instruction (check Event ID 4769 / msDS-SupportedEncryptionTypes)
since disabling RC4 without validating compatibility can break
legacy trusts, NAS devices, and third-party appliances.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance blockchain-developer based on automated review
- Add read-only reentrancy guidance to Security behavior rules and audit checklist
- Add bidirectional handoffs to smart-contract-auditor, smart-contract-specialist, and web3-integration-specialist
- Align Security Toolchain with sibling agents (Aderyn, Medusa, Halmos) and anchor on OWASP Smart Contract Top 10
- Add Non-EVM Security Notes (Solana/Anchor, Polkadot/ink!) and scope EVM-specific sections accordingly
- Add via_ir and L2 blob-calldata (EIP-4844/Fusaka) gas optimization guidance
- Name concrete monitoring/bug-bounty tooling (Forta, Tenderly, OpenZeppelin Defender, Immunefi) and add ERC-7683 intents to cross-chain guidance
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address review findings on blockchain-developer reentrancy and audit guidance
- Fix invalid guidance to apply nonReentrant (a state-writing modifier) to
view functions, which fails to compile; use a read-only lock-state check
instead
- Correct claim that cargo-contract provides ink! security-audit coverage;
it only builds/tests/deploys and should be paired with real static
analysis or an audit
- Regenerate the dashboard's generated component-content JSON for this
agent so the dashboard reflects the updated markdown source
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address second round of review findings on blockchain-developer
- Mention OpenZeppelin's nonReentrantView modifier (Contracts 5.6+) as the
standard view-safe reentrancy option, alongside the manual lock-state
check fallback
- Correct claim that cargo contract test deploys; it builds and runs unit
tests only, deployment is a separate step
- Stop conflating EIP-4844 blob data with calldata in L2 gas guidance;
describe them as separate, chain-specific costs
- Regenerate the dashboard's generated component-content JSON for this
agent
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Registers 4 read-only WebMCP tools (search-components,
get-component-details, get-install-command, get-catalog-stats) via
document.modelContext on every page, reusing src/lib/data.ts helpers and
the existing static JSON artifacts. Feature-detected and gated behind
PUBLIC_WEBMCP_ENABLED (same pattern as PUBLIC_ADS_ENABLED); no-op in
browsers without WebMCP support. Spec in dashboard/docs/webmcp.md.
Claude-Session: https://claude.ai/code/session_015ehgc17pAU4EcLbAjkzq7h
Entire-Checkpoint: 2ba83c996ee6
* feat(dashboard): sponsored placement display (CCT Ads), behind PUBLIC_ADS_ENABLED flag
Read-only groundwork for sponsored components: search (Cmd+K) and the type
grid pin an active sponsored component first with a 'Sponsored' badge, fed by
a public, cached /api/ads/active endpoint that exposes no user or payment
data. Inert by default — PUBLIC_ADS_ENABLED is not set, so no request is made
and search/grid behave exactly as before. Payments and administration live in
a separate private service and are intentionally not part of this repo.
Claude-Session: https://claude.ai/code/session_015ehgc17pAU4EcLbAjkzq7h
Entire-Checkpoint: b21c7ccd24e2
* fix(dashboard): never let the optional ads request delay the component grid
Address Greptile P1: the grid waited on Promise.all for the ads fetch, so an
ads outage could hold the catalog in its loading state for the full client
timeout. First paint now waits at most 1.5s for ads and applies them late if
they arrive afterwards; client timeout lowered to 5s.
Claude-Session: https://claude.ai/code/session_015ehgc17pAU4EcLbAjkzq7h
Entire-Checkpoint: 3e73f3601783
* fix(dashboard): address cubic review — flag-gate active endpoint, bound stale cache, keep keyboard anchor
- /api/ads/active returns [] without touching Neon while PUBLIC_ADS_ENABLED
is off, and no longer exposes row ids
- ads client serves last-known-good for at most 15 min during outages
- late ads responses (incl. empty) always applied so stale placements clear
- search keyboard selection re-anchors to the highlighted item when ads
reorder results instead of snapping to the top
Claude-Session: https://claude.ai/code/session_015ehgc17pAU4EcLbAjkzq7h
Entire-Checkpoint: 2dafd286ec68
* improve: enhance arm-migration based on automated review
- Declare Arm MCP server dependency via mcpServers block and add a
Prerequisites section, mirroring octopus-deploy-release-notes-mcp.md
- Fix incorrect tool name (learning_path_server -> knowledge_base_search)
- Rewrite description to drop GitHub Copilot framing and state the MCP
requirement up front
- Require build/test verification and a per-file change summary before
declaring success, instead of optional benchmarking
- Extend per-dependency compatibility checks to go.mod, Cargo.toml, and
Java build files (pom.xml/build.gradle)
- Add model: sonnet field and fix minor wording ("versionfiles" -> "version
files"; name the Arm MCP server explicitly)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address cubic review comments on arm-migration agent
- Grant mcp__arm__* in the tools: frontmatter so the MCP tools
referenced in the instructions are actually callable, not just
documented in the Prerequisites section
- Drop the /workspace absolute path reference to comply with the
repo's no-absolute-paths rule
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Component spotlight covering the documentation/technical-writer agent:
installation, how Claude Code subagents work, and a step-by-step
documentation workflow. Cover image generated with Higgsfield.
Co-authored-by: Claude <noreply@anthropic.com>
* fix(mcps): refresh trace-mcp counts and qualify the token-reduction claim
* fix(mcps): refresh trace-mcp counts and qualify the token-reduction claim
html2wp is a Claude Code marketplace that converts a static HTML site —
Lovable, Bolt, v0, Claude artifacts or hand-written pages — into a
standalone WordPress block theme.
The repo carries .claude-plugin/marketplace.json and plugin.json, so
generate_plugins_json.py can read it the same way as the other entries.
Co-authored-by: BELNEM s.r.o <hello@html2wp.dev>
* Add rote skill (workflow-automation)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Pin a version floor on every uvx invocation
An unpinned --from rote-cli resolves whatever is newest at run time;
the floor keeps the documented commands aligned with the CLI surface
this skill describes (rote 0.12.1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Point users at reviewed uv install methods instead of a piped remote script
Addresses the Greptile P2 finding: the skill no longer instructs the agent to
run curl | sh. It names package-manager installs and links the official uv
installation guide instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* improve: enhance business-analyst based on automated review
- Add "How This Differs From Related Agents" section
- Add Edit to tools allowlist
- Add Business Requirements Document (BRD) template
- Ground Requirements elicitation practice in IIBA BABOK Guide, expand techniques
- Soften Data analysis practice to clarify data is user-supplied
- Add anti-fabrication closing reinforcement
- Add confidentiality/PII pause criterion
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: clarify business-analyst cannot conduct direct observation itself
Addresses Greptile review feedback on PR #846: the added "direct
observation" elicitation technique implied the agent performs
in-person/live observation, which its file/web-only toolset cannot
support. Clarify it designs the observation protocol and synthesizes
notes/recordings supplied by the user or stakeholders instead.
* fix: instruct business-analyst to actually produce the BRD template
Addresses cubic review feedback on PR #846: the BRD template was
added but no step told the agent when to produce it or to use the
newly granted Write/Edit tools for it. Add a step in "When Invoked"
directing the agent to write the BRD via Write and keep it current
with Edit as requirements evolve.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-architect based on automated review
- Add Bash tool so the agent can run rover/graphql-inspector/autocannon commands its own guidance instructs
- Refresh Apollo Federation version guidance (2.10+ -> 2.12+) and add EOL callout for Router v1.x/Federation v2.9 (EOS March 2026)
- Add concrete Federation directive vocabulary (@key, @shareable, @override, @external, @provides, @requires, @interfaceObject) with a split-subgraph schema example
- Add schema-registry/CI workflow section (rover subgraph check/publish, GraphOS contract variants)
- Note WunderGraph Cosmo Router and Hive Gateway as vendor-neutral Federation-compatible gateway alternatives
- Cover @defer/@stream incremental delivery as an experimental, spec-pending feature with current tooling support
- Fix agent-integration reciprocity: add explicit delegation to graphql-security-specialist and graphql-performance-optimizer
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: define Warehouse entity in Federation @provides example
The inventory subgraph example referenced an undeclared Warehouse
type and code field via @provides(fields: "code"), which would fail
schema validation and Federation composition as written.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: make Warehouse.code the key field, split resolver into its own fence
The prior fix declared code as @external without any subgraph in the
example owning it non-externally, so composition would still fail.
Making code the entity's @key field resolves it locally instead. Also
split the JS reference resolver out of the graphql fenced block so the
schema snippet stays copy-paste valid.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: restore genuine @provides demonstration with a real warehouse subgraph
Making code the Warehouse key field made @provides on that field a
no-op (key fields are always locally resolvable, so nothing is being
provided). Added a third minimal warehouse subgraph that owns
Warehouse.label non-externally, and switched inventory's @provides to
that non-key field, matching Apollo's own canonical @provides pattern
(a field owned by one subgraph, shortcut-resolved by another).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: show inventory resolving label locally to fulfill @provides
The Product.warehouse resolver only showed __resolveReference, never
demonstrating that inventory actually resolves the @external label
field it claims to provide. Added a warehouse field resolver that
populates label directly, so the @provides contract is fulfilled as
documented rather than left implicit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: guard null warehouse in resolver to match nullable SDL field
warehouse: Warehouse is nullable in the SDL, but the resolver
dereferenced the loader result unconditionally, throwing on a
product with no warehouse instead of returning null.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-security-specialist based on automated review
- Add HTTP-level batch request overload protection, distinct from alias batching
- Add GraphQL Subscriptions / WebSocket security subsection (connection-time auth, subscription cap)
- Add concrete formatError implementation for the previously unimplemented error-handling principle
- Fix outdated `playground` option in the introspection example (removed in Apollo Server 3+)
- Clarify Apollo Server 4+ csrfPrevention default behavior
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address Greptile review findings on graphql-security-specialist
- Remove duplicate `const server` declaration in the introspection
example (SyntaxError when copy-pasted verbatim)
- Move WebSocket authentication to graphql-ws's onConnect hook so
unauthenticated connections are rejected before onSubscribe runs,
instead of authenticating late in the per-operation context callback
- Fix stack-trace masking to target Apollo Server 4's actual
extensions.stacktrace path instead of the obsolete Apollo Server 3
extensions.exception.stacktrace nesting
* fix: release subscription slot on onError, not just onComplete
graphql-ws does not call onComplete after onError for the same
operation, so a subscription that errors after onSubscribe increments
the per-connection counter never releases its slot, letting the count
leak toward the cap. Decrement in onError as well.
---------
Co-authored-by: Claude <noreply@anthropic.com>
Dani