* feat: add Function Hooks component type (experimental) with 10 hooks and blog
Introduce "function-hooks" as a new first-class component type based on
the Anthropic proposal in anthropics/claude-code#91870 (TypeScript hooks
as Koa-style middleware on a $ engine interface). The feature is not
shipped; every API name is provisional and the section is labelled
experimental everywhere.
- 10 function hooks under cli-tool/components/function-hooks/
(security, productivity, observability, ui, integrations, enterprise),
each as a .md doc page plus the installable .ts/.tsx hooks-module
- CLI: --function-hook installs the module as a local plugin under
.claude/plugins/<name>/ (plugin.json, hooks/hooks.json with modules)
and prints the experimental warning
- Catalog generator: scan function-hooks and emit dashboard artifacts
- Dashboard: type wiring, /function-hooks page with experimental banner
linking to the issue, Events/Module cards on the detail page,
sitemap, cart, webmcp; track-download now accepts loop/function-hook
- Blog: "Claude Code Function Hooks (Experimental)" article with cover
- Docs: CLAUDE.md and cli-tool rule
Claude-Session: https://claude.ai/code/session_01YBoJbmNMcRCexuKpH9mQtW
* fix: store function hooks as hooks.json + module, install as skills-dir plugin
Function hooks are not markdown docs. Per the proposal's architecture doc,
a function hook is a plugin's hooks/hooks.json with a "modules" key naming
a .ts/.tsx hooks-module beside it. Align the catalog and the CLI with that:
- Components are now {name}.json (hooks.json + catalog description) plus
the {name}.ts/.tsx module it names, mirroring how shell hooks store
.json + .py/.sh. The .md docs are removed.
- Generator reads the named module into the per-component content file
(module, moduleSource); the detail page renders the JSON and the module
with the experimental notice.
- CLI --function-hook downloads hooks.json and every module it names,
strips description, and writes the plugin to .claude/skills/{name}/,
which Claude Code auto-loads as {name}@skills-dir per the plugins
reference (no --plugin-dir needed).
- Docs and blog updated to the same install path.
Claude-Session: https://claude.ai/code/session_01YBoJbmNMcRCexuKpH9mQtW
* fix(function-hooks): address review findings
- CartSidebar: add --loop and --function-hook to TYPE_FLAGS so stack commands install them
- SendToRepoModal: export loops and function hooks (plugin layout with hooks.json + module)
- CLI: validate function hook identifier and hooks-module file names before building URLs/paths
- block-destructive-commands: rm rule now catches split flags, --recursive, quoted/trailing-slash targets, --no-preserve-root
- admin-capability-lockdown: shellPolicy deny|guardrail|allow; default withholds Bash, guardrail is labelled bypassable
- regenerate catalog
Claude-Session: https://claude.ai/code/session_01WsWgpvgeJgRMoLiYDcRXMU
html2wp is a Claude Code marketplace that converts a static HTML site —
Lovable, Bolt, v0, Claude artifacts or hand-written pages — into a
standalone WordPress block theme.
The repo carries .claude-plugin/marketplace.json and plugin.json, so
generate_plugins_json.py can read it the same way as the other entries.
Co-authored-by: BELNEM s.r.o <hello@html2wp.dev>
The ml-research entry from #613 was hand-added to the generated
dashboard/public/plugins.json without registering the repo in the
generator's REPOS list, so #697's regeneration silently dropped it.
- Add krasserm/ml-plugins to REPOS so the listing survives regeneration
- Restore the entry as produced by the generator's own process_repo(),
inserted in stars-descending order
- Generator: prefer plugin.json displayName for the display name
- Generator: for single-plugin repos, fall back to the locally scanned
component counts already collected for plugins_detail
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
GitHub now restricts the stargazers endpoint to a repo's own admins/
collaborators, so third-party live-chart services (star-history free tier,
starchart.cc) return 'Requires authentication' for everyone. Generate the
chart in-repo using the Actions GITHUB_TOKEN and commit a static SVG.
- scripts/generate_star_history.py: fetch stargazers, render theme-aware SVG
- .github/workflows/star-history.yml: weekly cron + manual regeneration
- README points to docs/star-history.svg
Clicking a plugin inside a marketplace (e.g. commit-commands in
claude-plugins-official) now opens a modal listing its actual
commands/agents/skills with names and descriptions, instead of just a
count badge. Also adds a live search box to filter plugins within a
marketplace page.
generate_plugins_json.py now fetches each component file's frontmatter
description (bounded by max_local_scans=50 locally-sourced plugins per
marketplace) and stores it in components_items, consumed by the new
MarketplacePluginsList.tsx island.
The pagination safety limit (1,000,000 records) was cutting off before
reaching the end of the table (1,382,542 records total), and since
pagination orders by id ascending (oldest first), the cutoff always
excluded the most recent ~380k downloads — exactly the data needed to
compute today/week/month trending correctly. This produced suspicious
output where todayDownloads == weeklyDownloads == monthlyDownloads
(94,484 each), which should be mathematically near-impossible.
Raised the limit to 10,000,000 (plenty of headroom over the current
table size) and regenerated both trending-data.json copies. New numbers
show the expected progression: today (132,189) < week (152,849) <
month (227,654) < total (1,340,064).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The dashboard is on Cloudflare Pages with a 24h edge cache already in
place, but every island still downloaded the full ~1.9MB index (327KB
gz) — even the sidebars/plugins/collection pages that only need per-type
counts. This splits the index into purpose-built artifacts so the
browser fetches only what each surface needs.
Generator (scripts/generate_components_json.py):
- Decouple the docs and dashboard index writes (they were a byte copy).
docs/components.json keeps `security` (the legacy site renders it);
the dashboard index drops both `content` and `security` (unused there)
→ ~13% smaller.
- Emit dashboard/public/counts.json (per-type counts, ~150 bytes),
components/{type}.json (per-type slices), and search-index.json
(flat name/description/category/type/path for global search).
Dashboard islands:
- ComponentGrid loads only the active type via fetchComponentsByType,
re-fetching on type switch (per-type in-memory cache).
- SearchModal (Cmd+K) uses the lighter search-index.json.
- Sidebar + plugins index/detail + collection pages fetch counts.json
instead of the full index just to read array lengths.
- data.ts gains fetchComponentsByType/fetchSearchIndex (additive);
fetchComponents() stays for the SSR detail page and Discord bot.
Fix: SendToRepoModal read `match.content` off an index that no longer
carries content, so "Send to repo" produced empty PRs / threw "No
component content found". buildFileMap now pulls each item's content via
fetchComponentContent (the per-component files), which also removes its
full-index fetch.
_headers: cache/CORS blocks for counts.json, components/*, search-index.json.
Payload (gzip on-the-wire): sidebars/plugins/collection 327KB → ~124B;
grid default type (agents) 327KB → 145KB; Cmd+K 327KB → 260KB.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add Loops component type with referenced components
Introduce "loops" as a new first-class component type — autonomous
agentic workflows (goal + interval + stop condition) inspired by Loop
Engineering and the Forward Future Loop Library. A loop references other
components (agents, skills, hooks, commands) and the dashboard renders
those references as clickable cards on the loop detail page.
- Add 10 starter loops under cli-tool/components/loops/
(engineering, evaluation, operations)
- Catalog generator: scan loops + write per-component content files
- Dashboard: new type in icons/types/data, /loops page, and a
"Referenced Components" section on the loop detail page
- CLI: --loop flag installs the loop to .claude/loops/ and
auto-installs its referenced components
- Docs: CLAUDE.md and cli-tool rule updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9ynMiCHt8JwdMd8KjCkES
* feat: add 8 more loops (goal/loop/schedule patterns)
Expand the loops catalog to 18, drawing ideas from community "Loop
Engineering" patterns. Adds loops across the three trigger verbs
(/goal, /loop, /schedule) and emphasizes the verifier-in-the-loop and
budget / anti-spin guardrails:
- engineering/five-minute-maintainer-loop
- engineering/build-test-fix-loop
- engineering/anti-spin-build-loop
- engineering/completion-contract-loop (goal)
- engineering/goal-refiner-loop (goal)
- engineering/adversarial-review-loop (cross-model)
- operations/overnight-pr-routine-loop (schedule)
- evaluation/human-approval-loop (human-in-the-loop)
All referenced components verified to exist; catalog regenerated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9ynMiCHt8JwdMd8KjCkES
---------
Co-authored-by: Claude <noreply@anthropic.com>
El commit anterior creó docs/component-content/ como directorio intermedio
y luego lo copió a dashboard/public/component-content/, resultando en 1774
archivos duplicados en el repo. Ahora el generador escribe directo al destino
final (dashboard/public/component-content/) y se agrega docs/component-content/
a .gitignore para evitar que se vuelva a trackear.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Split components.json: índice sin content (1.9 MB / 249 KB br vs 15.6 MB / 4.15 MB br).
Generador produce component-content/{type}/{slug}.json por componente y auto-copia
a dashboard/public/. Página de detalle carga contenido on-demand via fetchComponentContent().
- Restaurar cabeceras de caché y seguridad perdidas en la migración Vercel→Cloudflare:
_headers con Cache-Control max-age=86400 para JSONs, immutable para _astro/*,
y HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy en todas las rutas.
- Eliminar dashboard/vercel.json (config muerta desde migración a Cloudflare Pages).
- Diferir hidratación: ClerkIsland y AuthButton client:load → client:idle;
SaveToCollectionButton → client:visible.
- Eliminar gpt-tokenizer del bundle del navegador: reemplazado por estimación chars/4.
- Actualizar .claude/rules/dashboard.md para reflejar hosting en Cloudflare Pages.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Integrate NVIDIA's SkillSpector static analyzer (Apache-2.0) to scan
AI agent skills under cli-tool/components/skills/ for security issues
(prompt injection, data exfiltration, supply chain, dangerous code, etc.).
- scripts/skillspector_scan.py: batch orchestrator that discovers skill
dirs (by SKILL.md), runs `skillspector scan --no-llm --format json` on
each, and aggregates results into a Markdown PR report + SARIF log.
Tolerates per-skill scan failures and the CLI's non-zero exit on high
scores without aborting the batch.
- skill-security-scan.yml (PR): scans only changed skills, posts an
idempotent report comment, and blocks on HIGH/CRITICAL (score > 50).
- skill-security-scan-all.yml (weekly + manual): scans all skills,
reports to run summary and SARIF, never blocks.
- CLAUDE.md: document the scanning workflow.
Co-authored-by: Claude <noreply@anthropic.com>
Adds the official Airtable marketplace (Airtable/skills) to the /plugins
page. Includes:
- Entry in scripts/generate_plugins_json.py REPOS list so the next
regeneration run picks it up.
- Manual entry in dashboard/public/plugins.json so the marketplace
appears immediately, matching the format used by recent direct
additions (e.g., Mercado Pago, PR #576).
The marketplace currently contains 1 plugin (airtable) bundling 3 skills
(airtable-cli, airtable-filters, airtable-overview) and 1 MCP server
(https://mcp.airtable.com/mcp).
Strip absolute home directory paths from tool_args_summary before
rendering in ToolTimeline. Affects historical data already stored in DB.
Also adds scripts/run-review-cycle.sh for manual cycle testing with
--test-hook and --check modes.
- Add Python script (generate_plugins_json.py) that scans GitHub repos for
.claude-plugin/marketplace.json and plugin.json, extracting real component
counts by scanning plugin directories via GitHub API
- Replace static plugins.json with 30 verified repos (15 marketplaces,
15 individual plugins) with real stars and component data
- Add interactive PluginsGrid React component with search, sort by
stars/alphabetical, marketplace badge, and empty state
- Redesign plugin detail page: correct install instructions (/plugin
marketplace add), marketplace plugin listings with descriptions,
component breakdowns, and overview stats
* enhance: Improve prompt-engineer agent (automated review)
- Fix broken reasoning framework: complete Ordering field and Necessity scale
- Remove OpenAI attribution from description; add invocation example block
- Restrict tools to Read only (text-transformation agent needs no writes)
- Add XML Structure and CoT Opportunity dimensions to reasoning template
- Move meta-instruction NOTE out of output template, place as agent directive
- Fix stray markdown bold markers on Reasoning Before Conclusions guideline
- Integrate orphaned examples bullet into the Examples guideline line
- Add concrete worked example section (classify customer feedback)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* security: Harden CI/CD and repo for open-source safety
- Add --ignore-scripts to all npm ci/install in CI workflows and predeploy script
- Fix shell injection in discord-release-notification (use env vars + jq for payload)
- Add explicit permissions to all workflows (least privilege principle)
- Add root .npmrc with ignore-scripts=true
- Add .github/dependabot.yml for automated dependency security updates
- Add .github/CODEOWNERS to protect workflows, scripts, and API paths
- Expand .gitignore with *.pem, *.key, credentials.json patterns
* fix: Grant contents:read to deploy workflow so checkout works
Cubic correctly flagged that permissions: {} blocks actions/checkout.
* feat: Complete dashboard UI overhaul with dark mode theme system
- Added ThemeToggle component with persistent theme switching
- Implemented comprehensive dark mode styles across all dashboard pages
- Enhanced UI components: Sidebar, TopBar, ComponentGrid, TrendingView, JobsView
- Improved modal designs: SearchModal, SendToRepoModal, CartSidebar
- Updated featured pages and component detail pages with dark mode support
- Added CountryFlag component for jobs display
- Refined typography, spacing, and color schemes for better readability
- Enhanced interactive elements with smooth transitions and hover states
- Updated global styles with CSS variables for theme consistency
* docs: Add comprehensive PR documentation and screenshot guide
* docs: Transform PR into compelling business-focused summary
- Emphasize user benefits and platform value
- Highlight featured partner improvements (Neon, Vercel, Supabase, etc.)
- Detail expected business impact and metrics
- Add comprehensive business value section
- Include strategic benefits and revenue impact
- Professional acknowledgments from BitreonX team
- Focus on quality and attention to detail
* docs: Add executive summary highlighting business value and BitreonX quality
* docs: Add quick reference card for easy PR creation
* fix: resolve remaining P2 issues - sidebar active state, cart height, and date format
- Fix Sidebar.astro active-state icon styling to target nested span element
- Fix CartSidebar.tsx scrollable content height to be dynamic based on footer
- Fix WeWorkRemotely date format from RFC-2822 to ISO 8601 for proper sorting
* fix: use flexbox layout for CartSidebar instead of absolute positioning
Replace hard-coded height calculations with proper flexbox layout:
- Add flex-col to sidebar panel container
- Make header and footer shrink-0 (fixed size)
- Make content flex-1 with min-h-0 (fills remaining space)
- Remove absolute positioning from footer
- Remove hard-coded viewport height calculations
This ensures the scrollable content area dynamically adjusts to the
actual footer height without items being obscured.
* fix: resolve 11 additional P2 code review issues
- Fix malformed Tailwind classes in featured/[slug].astro (hover border syntax)
- Fix malformed Tailwind classes in MyComponentsView and SaveToCollectionButton
- Fix tooltip initialization non-idempotency in Sidebar (prevent duplicate listeners)
- Fix Recently Added sort mislabeling in ComponentGrid
- Fix single/multi-category filter conflict in ComponentGrid
- Fix tag click event bubbling in JobsView
- Fix SearchModal MutationObserver and timer cleanup
- Fix logo visibility issue in JobsView
- Fix fallback color construction in TrendingView
- Fix theme.ts localStorage trust issue with runtime validation
- Fix missing width/height in icon SVGs
- Fix XSS vulnerability in component detail page (use textContent)
- Fix sidebar overflow-x clipping tooltips
* fix: resolve SearchModal timeout race condition and Recently Added sort mismatch
- Fix SearchModal closeModal timeout cleanup using ref to prevent race conditions
when modal is closed and reopened quickly
- Fix Recently Added sort to use reverse name sort (Z-A) instead of downloads,
providing distinct behavior from Most Popular until actual date field is available
* fix: Remove misleading 'Recently Added' sort option
The 'Recently Added' sort was using reverse alphabetical order as a placeholder, which is misleading to users expecting actual recency. Since component data doesn't include creation dates, removed this option entirely.
Fixes violation P2 in PR #451
* feat(jobs): add Claude Code jobs section with free scraping pipeline
Add a new Jobs page (/jobs) and homepage preview showing positions that
require Claude Code. The scraper uses only free sources (HN Firebase API,
HN Algolia, RemoteOK, WeWorkRemotely RSS) with no API keys needed.
Runs daily via GitHub Actions alongside existing data updates.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(jobs): address all Cubic review feedback (P1+P2)
P1 fixes:
- Location parser now skips role titles (e.g. "AI-Native Technical Operations Lead")
- Salary extraction filters out funding/revenue amounts ($37M raised)
- applyUrl validated with safeUrl() to prevent javascript: injection
P2 fixes:
- timeAgo() handles NaN/invalid dates gracefully
- WeWorkRemotely IDs use URL slug instead of non-deterministic hash()
- GitHub Action diff check includes dashboard/public/claude-jobs.json
- Remote flag also checks description body for remote indicators
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(jobs): fix mojibake encoding and false salary extraction
- strip_html() now fixes common UTF-8 mojibake patterns (’ → ', â€" → —)
- Salary validation requires k/K suffix or >= $1000 for raw amounts
- Removes false positives: $100-140, $150-300 (ambiguous), $20K (bounty)
- Adds $X/yr pattern for single-value annual salaries
Addresses Cubic review comments #8, #9, #10.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(jobs): add Anthropic Careers source, auth gate, and UI improvements
- Add Greenhouse API collector for Anthropic career listings mentioning Claude Code
- Add Clerk auth gate requiring sign-in to view job links
- Add auth banner with sign-in CTA for unauthenticated users
- Improve description/tag color contrast (#999/#aaa) for dark theme
- Add Anthropic source badge (purple)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(jobs): address Cubic review — avoid unnecessary rerenders and remove candidate cap
- useGlobalAuth: only call setState when values actually change (prevents 500ms rerender loop)
- Remove hard cap of 80 Anthropic candidates to avoid dropping valid Claude Code roles
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Add MarkdownViewer, JsonViewer, SkillExplorer components with Code/Preview toggle, search (Cmd+F), TOC sidebar, and gradient fade expand/collapse
- Add FileTreeSidebar for skill file navigation (starts collapsed)
- Make file tree panel stretch to match content height
- Green download badge with icon on detail pages
- Remove Add to Stack button and sidebar collapse functionality
- Metadata displayed as clickable label pills with modal
- Add marked dependency for client-side markdown rendering
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Migrate all API endpoints from api/ (Vercel serverless) to dashboard/src/pages/api/ (Astro routes)
- track-download-supabase, track-command-usage, track-installation-outcome, track-website-events
- collections (index, [id], items)
- health-check, claude-code-check, discord/interactions
- Add shared API libs: cors.ts, neon.ts, auth.ts, changelog-parser.ts
- Add @supabase/supabase-js, @neondatabase/serverless, discord-interactions, @clerk/backend deps
- Remove catch-all API proxy ([...path].ts) - APIs are now native Astro routes
- Serve components.json and trending-data.json from dashboard/public/
- Switch to same-origin fetching (relative URLs) for data files
- Add dashboard/vercel.json with crons and CORS headers
- Simplify CI/CD to single deploy target (dashboard project)
- Update deploy script and package.json scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move VERCEL_ORG_ID, VERCEL_SITE_PROJECT_ID, and
VERCEL_DASHBOARD_PROJECT_ID to .env. Deploy script and deployer
agent now read from environment variables instead of hardcoding.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit includes several updates to the blog:
- Adds a new blog post creation command.
- Updates existing blog articles with new content and fixes.
- Regenerates blog images with a new script.
- Fixes a rendering issue in the skills-creator article by adding the necessary JavaScript for code block styling.
- Generated 4 blog cover images using Google AI Nano Banana (gemini-2.5-flash-image)
- Created generate_blog_images.py script for automated image generation
- Images: frontend-developer-agent, code-reviewer-agent, context7-mcp, skills-creator
- Professional tech/terminal aesthetic with orange accent colors
- 16:9 aspect ratio optimized for blog headers
- Move Google API keys to .env file (not tracked by git)
- Update generate_blog_images.py to use dotenv
- Update generate_blog_images_v2.py to use dotenv
- Add GOOGLE_API_KEY to .env.example
- Add critical security section to CLAUDE.md about never hardcoding secrets
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
New Blog Posts:
- code-reviewer-agent: Guide for automated code reviews
- context7-mcp: Context7 MCP integration guide
- frontend-developer-agent: Frontend development with Claude
- skills-creator: Creating custom Claude Code skills
New Scripts:
- generate_blog_images.py: Generate blog post images
- generate_blog_images_v2.py: Enhanced image generation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Daniel Avila