* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
Analytics Dashboard (Phase 1 + Phase 2):
- Replace 8663-line vanilla JS monolith with Astro static build
- New bento-grid layout with Geist design system (dark/light themes)
- ECharts (offline, tree-shaken) replaces Chart.js CDN dependency
- React island with KPI cards, token timeline, activity heatmap, agent BarList
- WebSocket client with reconnect backoff; polling fallback when WS disconnects
- API client with 30s cache; normalizes backend field names (inputTokens→totalInput)
- Build source in analytics-ui/, output committed to src/analytics-web/
- Fix: /api/activity now uses in-memory cache (was re-scanning all files on each request)
- Fix: remove duplicate /api/agents route (dead code since Express uses first match)
- Fix: /api/data and /api/fast-update no longer mutate this.data.conversations in place
TUI Modernization:
- Add src/tui.js with @clack/prompts-powered banner and helpers
- Replace inline showBanner() in bin/create-claude-config.js with tui.showBanner()
- Migrate showMainMenu() in src/index.js to @clack select() (replaces inquirer)
- Add @clack/prompts ^1.5.1 and gradient-string ^2.0.2 to dependencies
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add bash script support for hook installation
- Enable automatic download of .sh files for hooks
- LangSmith tracing hook now fully functional
Published to npm: claude-code-templates@1.28.13
- Remove timeline bar and date display from visualization
- Remove numbers from right panel (Models, Tools, Components lists)
- Implement collision detection system to prevent nodes overlapping
- Add restart function to clear permanent connection beams
- Clean up token tracking (removed from frontend display)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Group Plan, Explore, Agent subagents by type instead of individual IDs
- Aggregate counts per day to reduce timeline events
- Prevents rendering issues with thousands of subagent nodes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🎯 Skills Manager now detects skills from 3 sources:
- Personal: ~/.claude/skills/
- Project: .claude/skills/
- Plugin: ~/.claude/plugins/marketplaces/*/plugins/*/skills/*/
✨ Features:
- Added loadPluginSkills() to scan marketplace-installed skills
- Skills from /plugin install now appear in dashboard
- Detailed logging for debugging skill detection
- Fixed filter counts to show consistent totals
🔧 Improvements:
- Filter counts remain static regardless of active filter
- Shows total count for each category (All, Personal, Project, Plugin)
- Enhanced logging for better troubleshooting
- Supports skills installed via Claude Code plugin system
📦 Version: 1.28.3
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat: add session sharing and cloning functionality
Implement complete session sharing system for Claude Code conversations:
Features:
- Share button in chats interface with QR code generation
- Upload sessions to x0.at (temporary file hosting)
- Clone sessions with --clone-session command
- Limit shared sessions to last 100 messages
- Security confirmation modal with service information
- Resume command display after cloning
Backend:
- New SessionSharing class for export/upload/download/install
- Integration with ConversationAnalyzer
- x0.at upload service (tested and working)
- JSONL format conversion for Claude Code compatibility
Frontend:
- Confirmation modal with x0.at security info
- Centered QR code display
- Improved button styling (Resume, Share, Search)
- Real-time upload progress indication
CLI:
- Added --clone-session <url> parameter
- Automatic session installation to ~/.claude/projects/
- Display resume command with conversation ID
Dependencies:
- Added qrcode package for QR generation
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat: improve chats UI with project grouping and unified action buttons
Major improvements to chats interface:
Project Organization:
- Group conversations by project with collapsible sections
- Projects collapsed by default for cleaner interface
- Auto-expand projects during search with matching results
- Sticky project headers for better navigation
- Project avatars with gradients and conversation counts
Terminology Update:
- Changed "conversations" to "sessions" throughout UI
- Updated empty state messages
- Consistent terminology in headers and labels
Action Buttons Enhancement:
- Unified Resume, Share, and Search buttons in center header
- Replaced emojis with professional SVG icons
- Grouped design with orange accent border
- Individual hover states (green/blue/orange)
- Responsive button group with smooth transitions
Search Improvements:
- Fixed search to work with grouped project structure
- Search in both project names and session IDs
- Auto-collapse all projects when clearing search
- Proper filter clearing in advanced search
- Maintained state management across search operations
Visual Design:
- Orange accent border highlighting action buttons (2px)
- Subtle orange background for button group
- Consistent hover effects with color coding
- Enhanced visual hierarchy
- Better spacing and alignment
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Changes Made:
### 1. Modal Text Display Improvements
- Increased error/warning message font size from 14px to 16px for better readability
- Improved line height from 1.5 to 1.6 for better spacing
- Increased margin-bottom from 4px to 8px for better visual separation
### 2. Code Preview Text Wrapping
- Removed horizontal scroll (`overflow-x: auto`) from code previews
- Added `white-space: normal` to prevent excessive whitespace at line start
- Added `word-wrap: break-word` and `overflow-wrap: break-word` for proper text wrapping
- Applied to all code preview sections:
- Error line text previews
- Warning line text previews
- Example line text in errors
- Example line text in warnings
### 3. Line Number Scroll Synchronization
- Added `position: relative` to `.code-body` for better layout control
- Added `overflow: hidden` and `max-height: 600px` to `.code-line-numbers`
- Added `max-height: 600px` to `.code-content`
- Implemented JavaScript scroll sync between line numbers and code content
- Line numbers now scroll perfectly in sync with code content
### 4. Clickable Error Line Numbers
- Added `cursor: pointer` to error/warning line numbers
- Added "Click to see details" tooltip on error/warning lines
- Implemented click event listeners on all error/warning lines
- Click handler searches through validators to find matching error
- Opens validation modal with correct validator details when clicked
- Added hover effects with `transform: translateX(-2px)` and `cursor: help`
## User Experience Improvements:
- ✅ Error messages are now larger and easier to read (16px)
- ✅ Code snippets wrap naturally without horizontal scroll
- ✅ No excessive whitespace at the beginning of code lines
- ✅ Line numbers stay synchronized during scroll
- ✅ Error line numbers are interactive and open detailed validation modals
- ✅ Better visual hierarchy with improved spacing and sizing
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- Created conventional-commits.py for commit message validation
- Created prevent-direct-push.py for protected branch enforcement
- Updated all hook JSONs to use Python scripts with proper JSON output
- All hooks now use permissionDecision: "deny" for proper blocking
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Implement on_stdout/on_stderr callbacks for live output streaming
- Add progress indicators during long operations
- Remove unnecessary warning message for aitmpl.com API
- Create API endpoint for agents list at /docs/api/agents.json
- Update getAvailableAgentsFromGitHub to use aitmpl.com API fallback
- Improve user experience with visual feedback during execution
- Version bump to 1.21.5
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add visual separator and loading message after permissions check
- Show 'Executing Claude Code in secure cloud sandbox' message
- Include status indicators for processing, isolation, and output
- Improve user feedback during execution wait time
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add new statusline/context-monitor component with real-time context usage monitoring
- Implement automatic Python script download for statusline components
- Update installIndividualSetting to support additional files installation
- Add context-monitor.py with visual progress bars, color-coded alerts, and session analytics
- Modify generate_components_json.py to exclude .py files from component listings
- Use relative paths (.claude/scripts/) instead of hardcoded paths
- Support executable file permissions for Python scripts
- Version bump to 1.20.2
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
🚀 Released: Major new feature integrating Claude Code SDK
- Global agents accessible from anywhere with zero configuration
- Auto-detects project context and provides specialized AI assistance
- Complete CLI integration with create/list/update/remove commands
- Frontend integration with enhanced agent modals
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
🌍 Major new feature: Global AI Agents powered by Claude Code SDK
## New Features
- **Global Agent Creation**: `--create-agent <agent-name>`
- **Agent Management**: `--list-agents`, `--update-agent`, `--remove-agent`
- **Zero Configuration**: Agents install to /usr/local/bin (immediately available)
- **Auto Context Detection**: Smart project type detection and file context
- **Universal Access**: Works from any directory, in scripts, CI/CD, npm tasks
## Technical Implementation
- New global-agent-manager.js module with complete agent lifecycle
- Automatic PATH management across shell environments
- Executable script generation with Claude Code SDK integration
- Real-time loading indicators during AI processing
- Robust error handling and fallback mechanisms
## Frontend Integration
- Enhanced agent modals with Global Agent installation options
- New CSS styles for global agent sections
- Copy-to-clipboard functionality for all commands
- Usage examples and feature highlights
## User Experience
Before: Traditional project-based agent installation
After: `cct --create-agent security-auditor` → `security-auditor "prompt"` (anywhere)
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Upgraded jest-watch-typeahead from ^2.2.2 to ^3.0.1
- Resolves dependency compatibility issues causing npm install failures
- Version 3.0.1 provides improved Node.js compatibility and resolves known security vulnerabilities
- Updated package-lock.json to reflect the new dependency tree
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-authored-by: Claude <noreply@anthropic.com>
New Features:
- 🎯 Single prompt for batch installations - ask locations once for all components
- ✅ Accurate success counting - shows actual vs attempted installations
- 📝 General terminology - 'configuration components' instead of 'settings and hooks'
Improvements:
- ⚠️ Clear error messages when installations fail due to permissions
- 🔄 Consistent location selection across all components in batch mode
- 📋 Better feedback showing selected locations before installation
- 🎨 Cleaner user experience with no repeated prompts
Bug Fixes:
- Fixed misleading success messages when some locations fail
- Fixed repetitive prompts during batch installations
- Fixed inconsistent default locations between silent and interactive modes
Available on npm: npm install -g claude-code-templates@latest
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
✨ New Features:
- Interactive prompt to choose installation location for settings and hooks
- Support for all Claude Code configuration files hierarchy:
• User settings (~/.claude/settings.json) - Global for all projects
• Project settings (.claude/settings.json) - Shared with team
• Local settings (.claude/settings.local.json) - Personal, not committed
• Enterprise managed settings - System-wide policy (requires admin)
🖥️ Platform Support:
- macOS: /Library/Application Support/ClaudeCode/managed-settings.json
- Linux/WSL: /etc/claude-code/managed-settings.json
- Windows: C:\ProgramData\ClaudeCode\managed-settings.json
🔧 Technical Improvements:
- Unified installation logic for both hooks and settings
- Admin privilege detection and error handling for enterprise settings
- Proper directory creation for different installation locations
- Clear user feedback about target paths and requirements
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fixed CLI hook installation logic to properly handle Claude Code array format
- Improved hook merging to support both old and new formats during migration
- Published to npm with corrected hook processing capabilities
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add Shopify-style cart sidebar with drag-from-right animation
- Implement Add to Stack buttons for all component cards
- Create dynamic command generation for agents, commands, and MCPs
- Add cart state management with localStorage persistence
- Implement notification system with auto-dismiss
- Add social sharing for X/Twitter and Threads
- Create overlay copy buttons for command text in cards and cart
- Optimize card layout grid system (4 columns desktop, 2 tablet, 1 mobile)
- Add cart floating button with item count badge
- Fix scroll prevention and notification persistence issues
- Remove quotes from agent parameters in generated commands
- Implement compact cart item design with Clear All repositioning
- Add comprehensive cart styling with responsive design
- Include share functionality with proper URL encoding
- Update CLI package version to 1.14.16 for npm compatibility
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
spartan