* improve: enhance architecture-modernizer agent based on automated review
- Add required `model: sonnet` field (was missing, would fail component review)
- Add `Glob` to tools list for consistency with sibling agents and to
support file/module enumeration during service-boundary analysis
- Add closing "Integration with Other Agents" hand-off section reciprocating
legacy-modernizer's existing reference to this agent
- Add concrete tool-usage guidance (Grep/Glob for module/coupling
inventory, Bash for dependency-graph tooling, Write for ADRs/diagrams)
- Strengthen the closing risk/rollback guidance with named techniques
(contract tests, shadow traffic, feature flags, canary rollout, legacy
decommissioning, shared-database coupling)
- Add tactical DDD context-mapping detail to the Approach section
- Tie Output bullets to concrete artifact formats (ADRs, Mermaid, OpenAPI/AsyncAPI)
Automated review cycle
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRgMrRbDvzACuMDfhSHKnE
* fix: make ADR output location adapt to target repo convention
Address Greptile review feedback on PR #874: hardcoding docs/architecture/
ignores a target repo's existing ADR convention (e.g. docs/adr/,
docs/decisions/), creating a second decision-record hierarchy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KRgMrRbDvzACuMDfhSHKnE
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance data-engineer agent based on automated review
- Fix model field: claude-sonnet-4-5 -> sonnet (repo-wide convention)
- Add WebSearch tool for fast-moving tooling/pricing landscape
- Add explicit agent-boundary/hand-off language (database-architect,
ai-engineer, ml-engineer, database-optimizer)
- Rewrite data engineering checklist to replace absolutist claims with
negotiated, validated criteria
- Add Iceberg REST catalog layer (Apache Polaris, Unity Catalog OSS,
AWS Glue/S3 Tables) and real-time OLAP serving tools (ClickHouse,
StarRocks, Apache Pinot/Druid)
- Densify thin sections (pipeline architecture, stream processing, data
modeling, cost optimization, governance) with named tools
- Add DuckDB/MotherDuck, reverse ETL (Hightouch/Census), and
warehouse-native vector search alternatives
Automated review cycle
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
* fix: separate data-loss tolerance from delivery semantics in checklist
Greptile review flagged that the checklist conflated data-loss tolerance
with exactly-once vs. at-least-once delivery semantics. These are
distinct: at-least-once delivery can still guarantee zero loss via
dedup, and exactly-once processing can still lose data if source
retention expires before replay.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
* fix: scope Iceberg REST catalog clause to Iceberg only
cubic review flagged that the table-formats bullet implied the Iceberg
REST catalog applies to Delta Lake and Hudi too. Delta Lake and Hudi
have their own metadata/catalog mechanisms, so the clause is now
qualified to Iceberg specifically.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
* fix: avoid contradicting zero-loss-is-not-a-guarantee framing
cubic review flagged that "can still guarantee zero loss" contradicts
the checklist's own instruction two lines above not to claim zero loss
as a guarantee. Reworded to "can still achieve zero loss when replay
and idempotent/deduplicated writes are available."
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M5kDKgzGCerSPCR4SRXg5z
---------
Co-authored-by: Claude <noreply@anthropic.com>
* feat: add worktree-context-statusline setting
Minimal worktree-aware status line: project | branch | model | context.
Shows the main project name (not the worktree dir) inside linked
worktrees, marks the branch with ⑂, and reads accurate context usage
from Claude Code's context_window (200k or 1M) instead of guessing.
Regenerates the component catalog.
Claude-Session: https://claude.ai/code/session_01QHCvqCvD9JD9J6ZeAK8NS7
* fix(cli): make statusline script paths scope-aware
- Detect the companion .py from the statusLine command, not only the statusline/ name prefix
- For user/enterprise installs, rewrite .claude/scripts/ in the command to the absolute scripts dir where the file is actually written
Claude-Session: https://claude.ai/code/session_01WsWgpvgeJgRMoLiYDcRXMU
* feat: add Function Hooks component type (experimental) with 10 hooks and blog
Introduce "function-hooks" as a new first-class component type based on
the Anthropic proposal in anthropics/claude-code#91870 (TypeScript hooks
as Koa-style middleware on a $ engine interface). The feature is not
shipped; every API name is provisional and the section is labelled
experimental everywhere.
- 10 function hooks under cli-tool/components/function-hooks/
(security, productivity, observability, ui, integrations, enterprise),
each as a .md doc page plus the installable .ts/.tsx hooks-module
- CLI: --function-hook installs the module as a local plugin under
.claude/plugins/<name>/ (plugin.json, hooks/hooks.json with modules)
and prints the experimental warning
- Catalog generator: scan function-hooks and emit dashboard artifacts
- Dashboard: type wiring, /function-hooks page with experimental banner
linking to the issue, Events/Module cards on the detail page,
sitemap, cart, webmcp; track-download now accepts loop/function-hook
- Blog: "Claude Code Function Hooks (Experimental)" article with cover
- Docs: CLAUDE.md and cli-tool rule
Claude-Session: https://claude.ai/code/session_01YBoJbmNMcRCexuKpH9mQtW
* fix: store function hooks as hooks.json + module, install as skills-dir plugin
Function hooks are not markdown docs. Per the proposal's architecture doc,
a function hook is a plugin's hooks/hooks.json with a "modules" key naming
a .ts/.tsx hooks-module beside it. Align the catalog and the CLI with that:
- Components are now {name}.json (hooks.json + catalog description) plus
the {name}.ts/.tsx module it names, mirroring how shell hooks store
.json + .py/.sh. The .md docs are removed.
- Generator reads the named module into the per-component content file
(module, moduleSource); the detail page renders the JSON and the module
with the experimental notice.
- CLI --function-hook downloads hooks.json and every module it names,
strips description, and writes the plugin to .claude/skills/{name}/,
which Claude Code auto-loads as {name}@skills-dir per the plugins
reference (no --plugin-dir needed).
- Docs and blog updated to the same install path.
Claude-Session: https://claude.ai/code/session_01YBoJbmNMcRCexuKpH9mQtW
* fix(function-hooks): address review findings
- CartSidebar: add --loop and --function-hook to TYPE_FLAGS so stack commands install them
- SendToRepoModal: export loops and function hooks (plugin layout with hooks.json + module)
- CLI: validate function hook identifier and hooks-module file names before building URLs/paths
- block-destructive-commands: rm rule now catches split flags, --recursive, quoted/trailing-slash targets, --no-preserve-root
- admin-capability-lockdown: shellPolicy deny|guardrail|allow; default withholds Bash, guardrail is labelled bypassable
- regenerate catalog
Claude-Session: https://claude.ai/code/session_01WsWgpvgeJgRMoLiYDcRXMU
* improve: enhance documentation-expert based on automated review
- Soften "accuracy" checklist claim from execution-implying language to manual verification (agent has no Bash tool)
- Note overlap with technical-writer in Limitations, recommending using whichever is already installed
- Add accessibility checklist item and alt-text output guidance
- Reference llms.txt/AEO conventions and defer to llms-maintainer for llms.txt maintenance
- Operationalize "Docs as Code" with concrete linting tools and PR-review workflow
- Specify readability metric precisely as Flesch Reading Ease score
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SviPdqjmxanA9U4HEcuYvc
* fix: clarify AEO wording and sync generated dashboard content
- Reword "llms.txt/AEO conventions" to avoid ambiguity: this catalog
already uses "AEO" for two different meanings (AI Engine Optimization
in llms-maintainer vs Answer Engine Optimization in
search-ai-optimization-expert). Now spells out llms.txt's purpose
directly instead of relying on the overloaded acronym.
- Regenerate dashboard/public/component-content/agents/expert-advisors/documentation-expert.json
so the published detail page matches the updated agent body.
Addresses review-bot findings from cubic/greptile on PR #868.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SviPdqjmxanA9U4HEcuYvc
* fix: clarify Docs as Code linting is a CI recommendation, not agent-executed
The "Docs as Code in practice" bullet told the agent to "lint prose
with tools like Vale or alex" as if it could run them, but the agent
has no Bash tool — contradicting this PR's own rationale for softening
the accuracy checklist item. Reworded to make clear these are CI
checks the project runs, not something the agent executes itself.
Addresses cubic-dev-ai review finding on PR #868.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SviPdqjmxanA9U4HEcuYvc
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-performance-optimizer based on automated review
- Add graphql-jit query execution compilation strategy (hot operations, ~10x throughput, tradeoffs)
- Add totalCount/expensive aggregate field guidance for connection pagination
- Document client-side APQ retry flow (createPersistedQueryLink)
- Add caution note on HTTP batching vs horizontal load balancing
- Reference graphql-armor as consolidated production default alongside manual complexity wiring
- Mention max-aliases as complementary resource-exhaustion mitigation
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1RaEFP8KGektShfzukd4R
* fix: address review findings in graphql-jit example
- Key the compiled-query cache by operationName + query, since a document
can define multiple named operations that each compile to a distinct
function (previously the first-requested operation's compilation was
reused for all others in the same document).
- Replace the unbounded Map with a bounded LRUCache so a public API can't
be driven into unbounded compilation/memory growth by unique queries.
- Catch parse() errors and return them as a GraphQL error response instead
of letting them throw past the documented fallback.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1RaEFP8KGektShfzukd4R
* fix: clarify graphql-jit example's allowlist gate and cache-bound claims
- The comment claimed the snippet gates compilation behind an allowlist,
but the code compiles whatever query it receives. Reword to say the
snippet doesn't enforce that gate itself and that production use should
add it.
- The tradeoffs sentence attributed "unbounded cache growth" to an
unbounded allowlist, but the LRUCache above already bounds cache size
by entry count regardless. Reword to attribute the unbounded cost to
per-query compile CPU, not cache growth.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E1RaEFP8KGektShfzukd4R
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add OrcaReplay MCP component
Six stdio tools that let Claude Code read, explain and replay its own recorded runs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Disclose Node.js 20+ requirement in the component description
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* improve: enhance shopify-expert based on automated review
- Fix incorrect metafield type identifiers (single_line_text/multi_line_text -> single_line_text_field/multi_line_text_field, plus fill out the full type list)
- Add mandatory GDPR compliance webhooks (customers/data_request, customers/redact, shop/redact) to App Development guidance
- Flag the Legacy -> New Customer Accounts (OAuth 2.0/PKCE) transition in Common Scenarios and Theme File Structure
- Replace placeholder comments in the App Proxy example with real HMAC-SHA256 signature verification
- Add closing "Integration with Other Agents" and "Security Checklist" sections matching sibling agents in api-graphql/
- Note Rust as the higher-performance option for Shopify Functions, and add Billing API/B2B/Markets/Agentic Commerce coverage
Automated review cycle | Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JHpvzjn2H6xueDeHdga7ry
* fix: guard against uneven-length signature in App Proxy HMAC check
crypto.timingSafeEqual throws when its two buffers differ in length,
so a malformed (wrong-length) signature would raise an unhandled
exception instead of falling through to the intended unauthorized
response. Add a byte-length equality check before the comparison.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JHpvzjn2H6xueDeHdga7ry
* fix: separate GDPR webhook ack deadline from data-deletion deadline
The five-second HTTP acknowledgement deadline for Shopify compliance
webhooks was conflated with the 30-day deadline for completing the
underlying data request or deletion. State both separately.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JHpvzjn2H6xueDeHdga7ry
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-performance-optimizer agent based on automated review
- Broaden tools frontmatter to Read, Grep, Glob, Edit, Write, Bash (matches sibling agents; adds Edit for surgical resolver rewrites and Glob for file discovery)
- Add closing "Integration with other agents" section declaring delegation to graphql-architect, graphql-security-specialist, database-optimizer, backend-developer, frontend-developer
- Document OpenTelemetry GraphQL instrumentation as the recommended production monitoring approach, alongside the existing lightweight console.warn plugin
- Document Apollo Federation Demand Control (@cost/@listSize directives) in the Federation Performance section
- Replace artillery/autocannon load testing example with k6 (native GraphQL/WebSocket support), keeping artillery/autocannon as a note for simpler CI smoke tests
- Add a brief Client-Side Considerations section covering Apollo Client BatchHttpLink and Relay store GC tuning
Automated review cycle | Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhCvfh3VHh4nFcBy2Ft1fe
* fix: address bot review findings in graphql-performance-optimizer
- Fix invalid Federation demand-control SDL: add missing @link import
and use an int (not string) @cost weight; bump to federation/v2.12
to match the currently-supported LTS line per graphql-architect.md
- Correct OpenTelemetry section to stop claiming automatic DataLoader
batch-size instrumentation; add the manual span pattern actually
needed to get that signal
- Fix k6 load-test script to actually exercise both weighted queries
(previous version always sent queries[0]) and pass required
GraphQL variables for the parameterized query
- Guard the k6 error check against non-JSON error responses instead
of letting JSON.parse crash the check
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhCvfh3VHh4nFcBy2Ft1fe
* fix: randomize k6 GetUserDetails id per iteration
The hardcoded id: '1' meant the weighted query always exercised the
same row, skewing the load test's p95/error-rate thresholds via
per-row caching. Generate a distributed id per iteration instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HhCvfh3VHh4nFcBy2Ft1fe
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance ad-security-reviewer agent based on automated review
- Restrict tools to Read, Grep, Glob (removed Write/Edit/Bash) to match
the review-only nature of an auditor agent; document handoff of
remediation to powershell-security-hardening/windows-infra-admin
- Add AD CS / certificate-services abuse coverage (ESC1, ESC4, ESC6/7,
ESC8, full ESC1-16 via Certipy)
- Add Assessment Tooling section naming BloodHound, PingCastle, ADRecon,
Certipy/Certify as evidence sources
- Add a numbered "When Invoked" workflow and a concrete Markdown report
format with a severity table
- Expand attack-technique coverage: AS-REP roasting, Golden/Silver
tickets, NTLM-relay coercion (PetitPotam/PrinterBug), noPac,
Zerologon, Shadow Credentials, GPP cpassword, SID-history abuse, RBCD
- Anchor methodology to Microsoft's Enterprise Access Model (Tier 0/1/2)
and CIS Benchmarks
- Sharpen Kerberoasting/service-account remediation: gMSA migration,
AES-only Kerberos, disable RC4
- Add model: sonnet to frontmatter for consistency with sibling agents
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address Greptile review findings on ad-security-reviewer
- Replace inaccurate "Tier 0/1/2" labeling of the Microsoft Enterprise
Access Model with its actual Control Plane/Management Plane/
Data-Workload Plane terminology, noting the legacy Tier 0/1/2 model
is informally equivalent rather than identically named.
- Soften the unconditional "require AES-only Kerberos, disable RC4 for
all service accounts and trusts" guidance into an audit-first
instruction (check Event ID 4769 / msDS-SupportedEncryptionTypes)
since disabling RC4 without validating compatibility can break
legacy trusts, NAS devices, and third-party appliances.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance blockchain-developer based on automated review
- Add read-only reentrancy guidance to Security behavior rules and audit checklist
- Add bidirectional handoffs to smart-contract-auditor, smart-contract-specialist, and web3-integration-specialist
- Align Security Toolchain with sibling agents (Aderyn, Medusa, Halmos) and anchor on OWASP Smart Contract Top 10
- Add Non-EVM Security Notes (Solana/Anchor, Polkadot/ink!) and scope EVM-specific sections accordingly
- Add via_ir and L2 blob-calldata (EIP-4844/Fusaka) gas optimization guidance
- Name concrete monitoring/bug-bounty tooling (Forta, Tenderly, OpenZeppelin Defender, Immunefi) and add ERC-7683 intents to cross-chain guidance
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address review findings on blockchain-developer reentrancy and audit guidance
- Fix invalid guidance to apply nonReentrant (a state-writing modifier) to
view functions, which fails to compile; use a read-only lock-state check
instead
- Correct claim that cargo-contract provides ink! security-audit coverage;
it only builds/tests/deploys and should be paired with real static
analysis or an audit
- Regenerate the dashboard's generated component-content JSON for this
agent so the dashboard reflects the updated markdown source
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address second round of review findings on blockchain-developer
- Mention OpenZeppelin's nonReentrantView modifier (Contracts 5.6+) as the
standard view-safe reentrancy option, alongside the manual lock-state
check fallback
- Correct claim that cargo contract test deploys; it builds and runs unit
tests only, deployment is a separate step
- Stop conflating EIP-4844 blob data with calldata in L2 gas guidance;
describe them as separate, chain-specific costs
- Regenerate the dashboard's generated component-content JSON for this
agent
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance arm-migration based on automated review
- Declare Arm MCP server dependency via mcpServers block and add a
Prerequisites section, mirroring octopus-deploy-release-notes-mcp.md
- Fix incorrect tool name (learning_path_server -> knowledge_base_search)
- Rewrite description to drop GitHub Copilot framing and state the MCP
requirement up front
- Require build/test verification and a per-file change summary before
declaring success, instead of optional benchmarking
- Extend per-dependency compatibility checks to go.mod, Cargo.toml, and
Java build files (pom.xml/build.gradle)
- Add model: sonnet field and fix minor wording ("versionfiles" -> "version
files"; name the Arm MCP server explicitly)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address cubic review comments on arm-migration agent
- Grant mcp__arm__* in the tools: frontmatter so the MCP tools
referenced in the instructions are actually callable, not just
documented in the Prerequisites section
- Drop the /workspace absolute path reference to comply with the
repo's no-absolute-paths rule
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(mcps): refresh trace-mcp counts and qualify the token-reduction claim
* fix(mcps): refresh trace-mcp counts and qualify the token-reduction claim
* Add rote skill (workflow-automation)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Pin a version floor on every uvx invocation
An unpinned --from rote-cli resolves whatever is newest at run time;
the floor keeps the documented commands aligned with the CLI surface
this skill describes (rote 0.12.1).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Point users at reviewed uv install methods instead of a piped remote script
Addresses the Greptile P2 finding: the skill no longer instructs the agent to
run curl | sh. It names package-manager installs and links the official uv
installation guide instead.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* improve: enhance business-analyst based on automated review
- Add "How This Differs From Related Agents" section
- Add Edit to tools allowlist
- Add Business Requirements Document (BRD) template
- Ground Requirements elicitation practice in IIBA BABOK Guide, expand techniques
- Soften Data analysis practice to clarify data is user-supplied
- Add anti-fabrication closing reinforcement
- Add confidentiality/PII pause criterion
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: clarify business-analyst cannot conduct direct observation itself
Addresses Greptile review feedback on PR #846: the added "direct
observation" elicitation technique implied the agent performs
in-person/live observation, which its file/web-only toolset cannot
support. Clarify it designs the observation protocol and synthesizes
notes/recordings supplied by the user or stakeholders instead.
* fix: instruct business-analyst to actually produce the BRD template
Addresses cubic review feedback on PR #846: the BRD template was
added but no step told the agent when to produce it or to use the
newly granted Write/Edit tools for it. Add a step in "When Invoked"
directing the agent to write the BRD via Write and keep it current
with Edit as requirements evolve.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-architect based on automated review
- Add Bash tool so the agent can run rover/graphql-inspector/autocannon commands its own guidance instructs
- Refresh Apollo Federation version guidance (2.10+ -> 2.12+) and add EOL callout for Router v1.x/Federation v2.9 (EOS March 2026)
- Add concrete Federation directive vocabulary (@key, @shareable, @override, @external, @provides, @requires, @interfaceObject) with a split-subgraph schema example
- Add schema-registry/CI workflow section (rover subgraph check/publish, GraphOS contract variants)
- Note WunderGraph Cosmo Router and Hive Gateway as vendor-neutral Federation-compatible gateway alternatives
- Cover @defer/@stream incremental delivery as an experimental, spec-pending feature with current tooling support
- Fix agent-integration reciprocity: add explicit delegation to graphql-security-specialist and graphql-performance-optimizer
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: define Warehouse entity in Federation @provides example
The inventory subgraph example referenced an undeclared Warehouse
type and code field via @provides(fields: "code"), which would fail
schema validation and Federation composition as written.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: make Warehouse.code the key field, split resolver into its own fence
The prior fix declared code as @external without any subgraph in the
example owning it non-externally, so composition would still fail.
Making code the entity's @key field resolves it locally instead. Also
split the JS reference resolver out of the graphql fenced block so the
schema snippet stays copy-paste valid.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: restore genuine @provides demonstration with a real warehouse subgraph
Making code the Warehouse key field made @provides on that field a
no-op (key fields are always locally resolvable, so nothing is being
provided). Added a third minimal warehouse subgraph that owns
Warehouse.label non-externally, and switched inventory's @provides to
that non-key field, matching Apollo's own canonical @provides pattern
(a field owned by one subgraph, shortcut-resolved by another).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: show inventory resolving label locally to fulfill @provides
The Product.warehouse resolver only showed __resolveReference, never
demonstrating that inventory actually resolves the @external label
field it claims to provide. Added a warehouse field resolver that
populates label directly, so the @provides contract is fulfilled as
documented rather than left implicit.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
* fix: guard null warehouse in resolver to match nullable SDL field
warehouse: Warehouse is nullable in the SDL, but the resolver
dereferenced the loader result unconditionally, throwing on a
product with no warehouse instead of returning null.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ibUtHXEp8dkd9x7DCHUqi
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance graphql-security-specialist based on automated review
- Add HTTP-level batch request overload protection, distinct from alias batching
- Add GraphQL Subscriptions / WebSocket security subsection (connection-time auth, subscription cap)
- Add concrete formatError implementation for the previously unimplemented error-handling principle
- Fix outdated `playground` option in the introspection example (removed in Apollo Server 3+)
- Clarify Apollo Server 4+ csrfPrevention default behavior
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address Greptile review findings on graphql-security-specialist
- Remove duplicate `const server` declaration in the introspection
example (SyntaxError when copy-pasted verbatim)
- Move WebSocket authentication to graphql-ws's onConnect hook so
unauthenticated connections are rejected before onSubscribe runs,
instead of authenticating late in the per-operation context callback
- Fix stack-trace masking to target Apollo Server 4's actual
extensions.stacktrace path instead of the obsolete Apollo Server 3
extensions.exception.stacktrace nesting
* fix: release subscription slot on onError, not just onComplete
graphql-ws does not call onComplete after onError for the same
operation, so a subscription that errors after onSubscribe increments
the per-connection counter never releases its slot, letting the count
leak toward the cap. Decrement in onError as well.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance academic-research-synthesizer based on automated review
- Add WebFetch tool so the agent can retrieve full-text source content
(previously only WebSearch snippets were available, despite the prompt
promising methodology/statistics extraction)
- Add model: sonnet field (required by the repo's component-reviewer checklist)
- Reword arXiv/Semantic Scholar claims to match actual capability (reference
lists/related-work instead of citation-graph traversal); note the optional
arxiv-mcp-server MCP for deeper arXiv coverage
- Expand description with <example> blocks and a "when to use this agent vs.
comprehensive-researcher" note, for clearer automatic-delegation and
differentiation from the sibling agent
- Resolve citation-format ambiguity: (Author, Year) for academic sources,
[Source Name, Date] for web sources
- Add a Handoff section defining the output file convention
(research/{topic-slug}-synthesis.md) for downstream pipeline agents
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove fabricated handoff convention flagged by review bot
Neither episode-orchestrator nor project-supervisor-orchestrator consume a
research/ directory, and {topic-slug} was never defined anywhere in the
prompt. This team's agents already communicate via the orchestrator's
call_agent return value, not file handoffs (matches comprehensive-researcher
and market-research-analyst, which carry no such instruction either).
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance academic-researcher based on automated review
- Add Output Delivery section instructing writes to academic-research.md so research-synthesizer can discover it
- Rewrite description with <example>/<commentary> blocks matching sibling deep-research-team agents
- Add Preferred Sources & APIs guidance (Semantic Scholar, OpenAlex, Crossref, PubMed E-utilities, arXiv API) and require DOI/arXiv ID/PMID preservation
- Add structured JSON output block (claims, seminal_works, quality_flags, research_gaps) for pipeline consistency
- Add lightweight PRISMA-inspired Systematic Review Protocol subsection
- Add retraction/predatory-journal screening to the quality-check step
- Add explicit Citation format line
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: use YAML block scalar for academic-researcher description
Unquoted plain-scalar description contained colon-space sequences
(Context:, user:, assistant:) inside the <example> blocks, which
js-yaml parses as invalid nested mapping entries. Switching to a
block scalar (>-) preserves the content verbatim while keeping the
frontmatter valid YAML.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Usq1CFqiz6Kk1X9huJNM7P
* fix: use valid JSON literals in academic-researcher output example
Replace the type-placeholder tokens (`number`, `high|medium|low`)
in the example JSON block with concrete literal values so the
block is valid, parseable JSON if copied verbatim.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Usq1CFqiz6Kk1X9huJNM7P
* fix: mark academic-researcher JSON sample values as illustrative
Address follow-up review feedback: valid-but-concrete sample values
(25, "high") could be mistaken for required output rather than
placeholders. Add an explicit "do not copy verbatim" instruction
directly above the block.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Usq1CFqiz6Kk1X9huJNM7P
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance api-designer based on automated review
- Add real gRPC/protobuf service design coverage (proto example, service checklist, service.proto deliverable) to match the agent's advertised REST/GraphQL/gRPC scope
- Adopt RFC 9457 Problem Details for REST error responses, replacing the bespoke ApiError schema
- Update target spec version from OpenAPI 3.1 to OpenAPI 3.2, noting new streaming/SSE, additionalOperations, and OAuth2 Device Flow capabilities
- Add machine-readable/AI-agent discoverability guidance (predictable spec path, llms.txt/agents.json)
- Bring rate-limiting header guidance to parity with api-architect (RateLimit/RateLimit-Policy alongside Retry-After)
- Add permissionMode: acceptEdits and missing cross-agent references (graphql-architect, graphql-security-specialist, graphql-performance-optimizer)
- Pin Apollo Federation 2.10+ with required @link directive; reference AsyncAPI 3.0 for webhook specs
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct protobuf field-deprecation guidance in api-designer
A field number cannot be simultaneously declared (even as deprecated)
and listed in `reserved` - protoc rejects that. Clarify the two valid
patterns: keep a deprecated field's number declared, or reserve the
number only after removing the field entirely.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QAafnmzU8wyRwuyjr7hGg9
* fix: correct RFC 9457 ProblemDetails schema in api-designer example
Per RFC 9457 §3.1, all Problem Details members are optional (drop the
`required` constraint), and `type`/`instance` should use format
`uri-reference` since relative references like `/v1/transactions/abc123`
are valid but not valid absolute `uri` values.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QAafnmzU8wyRwuyjr7hGg9
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add missing model: sonnet frontmatter field (required by component-reviewer)
- Remove fabricated example metrics from progress tracking and delivery notification templates
- Add human-in-the-loop guidance to ask user for real scope/budget/timeline inputs
- Add Human-in-the-Loop Pause Criteria section
- Drop legacy query-context-manager/JSON requesting_agent protocol
- Consolidate generic keyword lists into a Core Practices section (RAID log, RACI matrix, CPM, EVM/SPI/CPI)
- Add How This Differs From Related Agents section
- Reword checklist items as targets to evaluate rather than pre-asserted facts
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* feat(mcps): add Sicex trade intelligence MCP server
Adds Sicex (sicex.com) as a remote MCP under components/mcps/web-data —
customs import/export and maritime shipment data for Latin American
markets, served over Streamable HTTP with OAuth 2.1 auth.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix(mcps): correct Sicex MCP coverage description
Data coverage isn't Latin-America-only — it spans the Americas, the
full European Union, and several Asian markets. Update the description
to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* Add repo-publication-auditor to security agents
The security category has agents for vulnerabilities, compliance, pen testing and
supply chain. None covers the one-time, irreversible act of making a repository
public, which fails in ways a vulnerability audit does not look for. git/
commit-guardian is adjacent but per-commit and staged-files only; this is the
whole history at the moment of publication.
Every check came out of a real mistake rather than a checklist:
- The history is the artifact. Auditing git status misses a secret removed in a
later commit, and .gitignore added after the fact never untracks anything.
- GitHub attributes a commit by the email in the commit object, so a repository
can publish an employer on every line of its contribution graph. The agent
reports the count, because 665 of 673 commits is a different decision from 2.
- Push protection treats an invented credential exactly like a real one, and
partner scanning forwards an AKIA string to the vendor within minutes. So the
agent recommends placeholders plus a seeded generator rather than telling an
owner to weaken a redaction-test fixture.
- A README number measured in the author's working copy can be measuring
something else, because tools that resolve a project root by walking up find
the outer repository when a project sits inside one. The agent re-runs the
README's own commands in a fresh clone.
Every shell command in it was run before being written down, against real
repositories, and each found real instances.
One file. The components catalog JSONs are regenerated by update-json-data.yml
on a schedule, so they are deliberately not hand-edited here.
* fix(repo-publication-auditor): the Windows path grep never matched, and the history sweep had no command
Both findings came from review on davila7/claude-code-templates#820 and
both reproduce.
C:\\\\Users\\\\ in an ERE is two literal backslashes, so it matched only an
already-escaped path and missed the real C:\Users\name it exists to
find. Using \\+ catches one backslash or several, so a raw path and a
JSON-escaped one both hit. Verified against a fixture holding both forms,
and against C:/Users and CUsers for false positives.
"Run these against the history too" named no command, which left the
agent to improvise its central check. The credential greps read the
checkout only, and a key deleted in a later commit is still served by the
API — so a tree-only scan calls a leaking repository clean. Added the
git grep form over git rev-list --all, with the output shape and an
explicit note to state when a sweep was scoped rather than full.
Verified by extracting the file's own bash blocks and running them: in a
repo whose first commit holds an AWS key and whose second removes it, the
tree scan is silent and the history scan returns the commit.
* fix(repo-publication-auditor): the history sweep dropped a pattern and did not run under zsh
Three faults in the block added by the previous commit, two found in
review and the third by running it.
The database-URL grep exists in the tree scan and was missing from the
history sweep, so a postgres/mysql/mongodb URL with embedded credentials
was caught in the checkout and missed once removed — the one case the
history sweep exists for.
git grep ... $REVS relies on the shell word-splitting an unquoted
variable. zsh, the macOS default, does not: git receives the entire list
as a single argument and fails with 'unable to resolve revision'. The
command did not work at all on the platform most likely to run it, which
review could not see because reviewers read bash semantics. On a large
enough repository the bash form then overruns ARG_MAX, which was the P2.
Piping through xargs -n 200 fixes both.
The revisions must not be followed by -- <path>: xargs appends them last,
and anything after -- is read as a path, which silently turns the sweep
back into a working-tree scan with no error and no commit prefix. Removed
the suggestion to scope it that way and said why.
Verified under zsh against a repo whose first commit holds an AWS key and
a postgres URL and whose second removes both: the tree scan is silent and
the history sweep returns the commit for each.
* improve: enhance adr-generator based on automated review
- Fix absolute-path bug: docs/adr/ was written with a leading slash
(filesystem-root-absolute); now explicitly repo-root-relative
- Rewrite description with trigger phrases and 3 <example> blocks to
drive automatic subagent delegation, matching postgres-pro/api-documenter
- Add explicit model: sonnet field (required by component-reviewer)
- Fix ambiguous ALT-XXX coding scheme: each alternative now gets one
stable ALT-NNN code reused for Description and Rejection Reason
- Add workflow step to cross-reference and cross-link existing/superseded
ADRs (search docs/adr/, update superseded ADR's status/superseded_by)
- Narrow tools: drop unused Bash, keep Read/Grep/Glob/Edit/Write
- Add Decision Drivers section (MADR-style) and a grounding instruction
to verify claims against the real repository state
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: correct YAML newline escaping and supersedes step ordering
Addresses cubic review findings on PR #829:
- description frontmatter used doubled \\n instead of \n, so the
YAML double-quoted scalar rendered literal backslash-n text
instead of real newlines between the <example> blocks
- Step 2.5 set the new ADR's supersedes field before the new ADR
file existed (it's only created in Step 3); moved that to Step 3
and kept only the old ADR's Edit update in Step 2.5
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNoo8usoppzPaZkETzVo3R
* fix: use file-relative path in ADR cross-reference example
Addresses a greptile review finding on PR #829: the example
References link used docs/adr/adr-0003-....md, which resolves
under docs/adr/docs/adr/ since ADRs already live in that directory
— a broken link. Use ./adr-0003-....md (relative to the generated
ADR file) instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNoo8usoppzPaZkETzVo3R
* fix: resolve NNNN/MMMM placeholder collision in supersession steps
Addresses a cubic review finding on PR #829: NNNN means "this ADR's
own number" everywhere else in the doc, but Step 3 used it to mean
the superseded ADR's number while Step 2.5 called the new ADR's own
number MMMM instead — risking self-supersession or a mis-filled
superseded_by. Step 2.5 now consistently uses NNNN for the new ADR's
own number; Step 3 uses a distinct OLD placeholder for the
superseded ADR's number.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNoo8usoppzPaZkETzVo3R
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance computer-vision-engineer based on automated review
- Fix deprecated TensorRT 10.x API (build_serialized_network, set_memory_pool_limit)
- Add Foundation & Zero-Shot Vision Models section (SAM2/SAM3, Grounding DINO,
CLIP, Florence-2, multimodal LLMs) with a model selection framework
- Update default detector to YOLO11 with AGPL-3.0 licensing note and
RT-DETRv2/RF-DETR alternatives
- Modernize face recognition guidance to InsightFace/DeepFace, keep dlib
face_recognition as a lightweight fallback only
- Add multi-object tracking (ByteTrack via model.track) to video analysis
- Replace unimplemented document-structure stub methods with a layoutparser-based
approach and pointers to unstructured/VLM alternatives
- Add a Compliance & Ethical Considerations section for biometric/PII data
- Align frontmatter/structure with sibling data-ai agents: add model: sonnet,
Glob/Grep tools, multi-example description, and an Integration with Other
Agents section with explicit boundaries vs ai-engineer and ml-engineer
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: reset ByteTrack state between independent video streams
Reusing a VideoAnalyzer instance for a new stream would otherwise carry
stale track IDs from the previous session, since persist=True caches
tracker state on the model's predictor.
Addresses review feedback on PR #821.
* fix: stop prior stream's threads before starting a new one
start_real_time_analysis previously only reset tracker state but left
any earlier capture/process threads running against the same
frame_queue/result_queue/model, so a reused VideoAnalyzer instance could
mix frames and tracker state across streams. Add stop_processing() to
join the old threads and drain the queues before starting a new stream.
Addresses further review feedback on PR #821.
* fix: correct layoutparser color channel and text-region filter
- Convert BGR (cv2.imread) to RGB before Detectron2LayoutModel.detect(),
since PubLayNet was trained on RGB
- Include PubLayNet's 'Title' and 'List' labels in text_regions, not
just 'Text', so headings and list blocks aren't dropped
Addresses cubic review feedback on PR #821.
* fix: unblock capture thread on stop and fail loudly if it won't die
cap.read() blocks until a frame arrives, so join(timeout=5.0) alone
could return with the capture thread still alive and start_real_time_analysis
would then reuse the shared model/queues underneath it. stop_processing
now releases the VideoCapture to unblock read() immediately, and raises
if a thread still hasn't exited after the join timeout instead of
silently proceeding.
Addresses further greptile review feedback on PR #821.
* fix: re-check thread liveness on retry instead of the processing flag
stop_processing() sets self.processing = False before it can guarantee
the old threads have exited (e.g. one is still blocked in model.track()
past the join timeout and it raises). A caller retrying
start_real_time_analysis after that RuntimeError would see
self.processing already False and skip straight to relaunch, letting
the still-alive worker resume against the shared model/queues once it
unblocks. Guard on actual thread.is_alive() instead so a retry keeps
re-joining until the old threads are confirmed dead.
Addresses further greptile review feedback on PR #821.
* fix: call stop_processing unconditionally to always drain queues
Gating stop_processing() on thread liveness skipped the queue drain
whenever the previous call's stuck thread had exited by the time of a
retry (the liveness check would then be False), leaking stale
frames/results from the old stream into the new one. stop_processing is
idempotent for dead/None threads, so call it unconditionally instead.
Addresses cubic review feedback on PR #821.
* fix: guard tracker reset against predictor without trackers attribute
Ultralytics only registers .trackers on the predictor once model.track()
has run at least once. If this model instance was previously used with
model.predict()/model() (plain inference, no tracking), self.model.predictor
exists but lacks a trackers attribute, so the direct attribute access
raised AttributeError and aborted stream startup. Use getattr with a
default instead of assuming the attribute exists.
Addresses further greptile review feedback on PR #821.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- doordash-group-orders: quote description (contains ": ")
- ray-data, ray-train: quote `ray[data]` / `ray[train]` inside the
dependencies flow sequence (nested brackets are invalid there)
- motion-canvas: quote `@motion-canvas/*` dependency entries (`@` is a
reserved indicator and cannot start a plain scalar)
- agirails-agent-payments: drop a stray leading `+` on the description
line left over from a diff paste
- scholar-evaluation: add missing frontmatter (name + description taken
from the existing Overview paragraph)
All six were skipped by `npx skills add davila7/claude-code-templates`;
verified 0 skipped after this change.
Co-authored-by: cj <cj-ant@users.noreply.github.com>
* improve: enhance data-analyst based on automated review
- Add missing model field (sonnet)
- Add clarifying-questions preamble before starting analysis
- Fix stale Data Studio reference to Looker Studio
- Ground vague concept lists with concrete tools & libraries
- Add Responsible Analysis section for data privacy/governance
- Remove stray duplicate blank line
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address cubic review findings on data-analyst
- Remove orphaned Communication Protocol / Analysis Context block
(get_analysis_context) left dangling after the "Query context manager"
step was replaced by the clarifying-questions preamble; the reference
sibling data-scientist.md has no equivalent block either.
- Drop the duplicated tool-name parenthetical on "Business intelligence"
now that the same names live in the single "Tools & libraries" list.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
There is no cost or FinOps MCP in the catalog today. nable answers spend
questions across AWS, Azure, GCP, Kubernetes and 15+ SaaS and AI
providers, and drafts the Terraform fix as a pull request a human
reviews.
Runs with uvx, like the nine existing uvx components. Needs no API key
in the config: it reads the cloud credentials already on the machine.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* improve: enhance accessibility-tester agent based on automated review
- Fix pa11y guidance to use --runner axe (default htmlcs runner is WCAG 2.0-era, misses 2.1/2.2 violations)
- Note axe-core version requirement (>=4.5) for reliable WCAG 2.2 rule coverage
- Annotate which WCAG 2.2 new criteria are actually automatable (only 2.5.8 via axe-core target-size)
- Add a fully worked example finding to anchor severity/remediation phrasing
- Add document/PDF accessibility checklist item (Section 508/EAA scope)
- Add forced-colors / prefers-contrast manual checklist item
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: cover prefers-contrast alongside forced-colors in accessibility-tester
Addresses review feedback on PR #814 — the manual checklist tested
Windows High Contrast (forced-colors) but omitted the distinct
prefers-contrast media feature, which interfaces can also use for
alternate high-contrast styling.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTTuf1dEt7QW83eyAPV7Lm
* fix: require both forced-colors and prefers-contrast checks explicitly
The previous wording used "or", allowing an audit to satisfy the
checklist item by testing only one of the two distinct contrast
display modes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTTuf1dEt7QW83eyAPV7Lm
* fix: correct pa11y WCAG 2.2 coverage claim and axe-core version check scope
pa11y's axe runner maps WCAG2AA to wcag2a/wcag21a/wcag2aa/wcag21aa tags
only (confirmed against pa11y/pa11y#666 and lib/runners/axe.js) — it does
not include wcag22aa, and pa11y has no --tags CLI flag. Also scope the
axe-core version check to the tool actually being run, since
@axe-core/cli --version only reports its own bundled axe-core, not
pa11y's or @axe-core/playwright's independently-resolved versions.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTTuf1dEt7QW83eyAPV7Lm
* fix: give a concrete command for checking per-tool axe-core versions
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QTTuf1dEt7QW83eyAPV7Lm
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance model-evaluator based on automated review
- De-anchor hardcoded/aging model names (GPT-4o, Gemini 1.5, etc.) in
frontmatter examples and Model Categories, replacing them with
capability-tier language and a prominent instruction to verify
current model IDs via WebSearch/WebFetch before recommending or
testing
- Add a "Required Initial Step: Requirements Gathering" section,
matching the pattern used by sibling agents llm-architect and
prompt-engineer
- Add WebFetch to the tools list for pulling full pricing/leaderboard
pages (LMSYS Arena, HELM) beyond WebSearch snippets
- Add Inspect AI and OpenAI Evals to the Standard Frameworks & Tools
table
- Fix imprecise terminology: replace "GitHub Copilot" (a product, not
a benchmarkable model) with actual code-specialized models, and
clarify "Vision" models are a native capability rather than a
separate SKU
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: align tier language in model-evaluator example
The first description example's Context named balanced/flagship tiers
but the assistant response evaluated budget/balanced tiers instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FHagP9k8UdbMyPJHjmYaTy
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance prompt-engineer based on automated review
- Add WebSearch to tools frontmatter, matching sibling ai-specialists agents
- Add 4th description example covering Claude Code subagent/skill prompt optimization
- Add guidance on avoiding aggressive imperative language (CRITICAL/YOU MUST/NEVER EVER) that causes overtriggering on current models
- Route target-model answer to model-specific prompting guidance (verbosity, effort calibration, delegation, tool-triggering)
- Add long-context document placement guidance (documents near top, instructions/query at end)
- Expand agentic prompting into concrete sub-guidance (tool-triggering, overeagerness containment, destructive-action confirmation, tool-error handling, autonomy boundary)
- Sharpen budget_tokens deprecation language (returns HTTP 400 on current models; effort/max_tokens is the replacement)
- Reference Structured Outputs as a response-parsing option
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: qualify budget_tokens claim by model generation, regenerate catalog
Addresses PR review feedback:
- cubic-dev-ai/greptile: dashboard/catalog artifacts were stale after the
prompt-engineer edits (old tool allowlist, 3-example description) —
regenerated via scripts/generate_components_json.py.
- cubic-dev-ai: the budget_tokens deprecation claim was overbroad — it now
varies correctly by model generation instead of asserting a blanket
HTTP 400 on all "current" models.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance task-decomposition-expert based on automated review
- Trim tools allowlist to Read, Glob, Grep, WebSearch (drop unused Write/Edit/Bash)
- Add "Boundaries with Related Agents" section distinguishing from project-manager and scrum-master
- Instruct grounding the WBS in the actual codebase via Read/Glob/Grep before finalizing
- Add PERT (three-point) estimation guidance for Medium+ complexity tasks
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: address review feedback on task-decomposition-expert
- Regenerate the dashboard content mirror so it matches the trimmed
tool allowlist and new prompt sections (Greptile/cubic P2).
- Reword the Boundaries section so it no longer claims project-manager
and scrum-master appear in the Agent Handoff Plan table (cubic P3).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZwwQ2MD4wsrwTJi5yM515
---------
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance salesforce-expert agent based on automated review
- Add required model field (sonnet) to frontmatter
- Replace invalid tools list (vscode, execute, sfdx-mcp/*, agent, todo) with valid Claude Code tool names
- Replace generic description with routing-oriented description plus 3 <example>/<commentary> blocks
- Add Agentforce & Agent Actions subsection (exposing Apex as Agentforce Actions, Topics/Instructions, guardrails)
- Add Flow vs. Apex decision-guidance subsection
- Add Lightning Web Security (LWS) and API-version-pinning guidance to operationalize the Release Aware Developer persona
- Add Salesforce CLI Commands Reference section using the current unified sf CLI, noting sfdx is legacy
- Normalize bullet indentation to a single "- " marker
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: remove TodoWrite from salesforce-expert tools allowlist
TodoWrite isn't in StructuralValidator's accepted tool identifiers
(Read, Write, Edit, Bash, Glob, Grep, WebSearch, WebFetch, *), which
was flagging STRUCT_W006 on the PR.
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add required model field (sonnet) to frontmatter
- Name specific database engines (PostgreSQL, MySQL, MongoDB, Redis) in description and Focus Areas
- Add credential-safety instruction to Approach (env vars / secrets manager)
- Add Glob, Grep to tools field for locating existing config files
- Add differentiation/handoff note vs postgres-pro and database-optimizer
- Name concrete per-engine monitoring commands and schema migration tooling
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Local MCP connects Claude Code to 160+ native macOS apps (Mail,
Calendar, Contacts, Messages, Notes, Reminders, Safari, Teams,
Slack, WhatsApp, OneDrive, Google Drive, M365, Outlook, Office
docs, and more) via a free local tray app. No API keys required.
https://local-mcp.com
Co-authored-by: LMCP <lmcp@LMCPs-Mac-mini.local>
- Resolve name collision: rename cli-tool/components/agents/deep-research-team/search-specialist.md
to multi-source-searcher.md (both filename and frontmatter name field), since it
duplicated the canonical, higher-adoption ai-specialists/search-specialist.md and
both installed to the same .claude/agents/search-specialist.md target path.
Updated the cross-reference in research-analyst.md accordingly.
- Tighten WebFetch guidance in ai-specialists/search-specialist.md to request
verbatim extraction and note that WebFetch only returns raw text unmodified for
Markdown sources under ~100K characters (otherwise a smaller model paraphrases it).
- Add a "Handling Untrusted Content" section instructing the agent to treat fetched
page content as untrusted data, not instructions, and flag rather than act on
embedded directive-like text (prompt-injection hardening).
- Clarify that allowed_domains/blocked_domains are mutually exclusive per WebSearch call.
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
* improve: enhance llms-maintainer based on automated review
- Make content-discovery directories framework-aware (Astro/Nuxt/Next/SvelteKit) instead of a fixed generic list
- Add detection and scan paths for Docusaurus, VitePress, and Jekyll
- Raise maxTurns from 20 to 50 and add a batching/graceful-truncation strategy for large sites
- Add "Use PROACTIVELY" to the description for reliable automatic delegation
- Gate automatic git commits behind explicit user confirmation, consistent with the deletion-confirmation safety rule
- Add optional llms-full.txt companion generation, opt-in only
- Clarify that description/title length limits and the blockquote/H2 sections are house-style conventions, not llms.txt spec requirements
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: use detected output path when staging llms.txt, not hard-coded public/llms.txt
Addresses Greptile review feedback on PR #794: the Step 8 git-add command
was hard-coded to public/llms.txt, which misses the actual output path for
SvelteKit/Hugo/Docusaurus (static/llms.txt), VitePress (<srcDir>/public/llms.txt),
Jekyll (llms.txt at repo root), and the optional llms-full.txt companion.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: resolve Next.js hybrid-router ambiguity and Jekyll _posts/ ignore-rule conflict
Addresses cubic review feedback on PR #794:
- The two separate Next.js detection bullets were not mutually exclusive;
a hybrid app/+pages/ setup would have legacy pages/ routes silently
omitted. Now scans both when both exist, preferring app/ for output.
- Step 3's blanket "/_*" ignore rule would have silently skipped every
Jekyll post, since _posts/ starts with an underscore. Added an explicit
exception for _posts/ while still ignoring other Jekyll internals.
Co-Authored-By: Claude Code <noreply@anthropic.com>
* fix: extend Jekyll ignore-rule exception to configured collection dirs
Addresses cubic review feedback on PR #794: the underscore-path exception
only covered _posts/, but Step 1 also tells the agent to scan Jekyll's
configured collections (e.g. _projects/, _team/), which are similarly
underscore-prefixed and were getting silently filtered by Step 3's ignore
rule.
Co-Authored-By: Claude Code <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Daniel Avila