* feat(cli-rust): add Rust port of the CLI core with npm distribution + CI
Adds a new `cli-rust/` crate (binary `cct`) that ports the CORE of the
claude-code-templates CLI to Rust, alongside the existing Node `cli-tool/`.
Native (byte-parity with the Node CLI, verified via `diff -r`):
- Component installation: --agent/--command/--mcp/--setting/--hook/--skill
and --workflow YAML, replicating the exact GitHub raw/API URLs, target
paths (flat dir, category dropped), .mcp.json/settings/hooks merge
semantics, .py/.sh sidecars, 2-space JSON + trailing newline.
- Fire-and-forget tracking (3 endpoints, detached threads, env opt-out).
Delegated to the Node CLI for now (commands/delegate.rs forwards argv via
CCT_NODE_BIN or `npx claude-code-templates@latest`): dashboards, sandbox,
global agents, stats, health-check, interactive setup.
Parity gotcha handled: serde_json Map::remove does swap-remove under
preserve_order; switched to shift_remove to match JS `delete` key order.
Distribution: npm shim (npm/cct/bin/cct.js) execs a prebuilt binary from
optionalDependencies (@davila7/cct-<os>-<arch>, esbuild pattern) so `npx`
keeps working; plus Homebrew, cargo-binstall, and install.sh from GitHub
Releases. build-rust-cli.yml builds all 5 targets on tag `cli-rust-v*`.
Tests: 23 offline unit/integration tests + 2 network integration tests
(#[ignore]). fmt + clippy clean.
CI: rust-ci.yml runs fmt + clippy + tests only when cli-rust/** changes and
posts a sticky PR comment with the results.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(cli-rust): address cubic review (config safety, opt-out, packaging, CI)
Fixes from the cubic automated review on PR #640:
- install.rs: fail safe on a corrupt/unreadable existing .mcp.json/settings
file instead of silently overwriting it (MCP aborts; setting/hook skip the
location), matching Node's throw-on-bad-config behavior.
- tracking.rs: honor both `=1` and `=true` as opt-out values (the README
documents `=1`); Node only checks `=true`, so this is more privacy-safe.
- cli.rs/main.rs: implement --dry-run for the native install path (prints the
plan, writes nothing) instead of parsing the flag and ignoring it.
- main.rs: run_prompt surfaces a non-zero `claude` exit code (a missing
`claude` stays a soft warning since the install already succeeded).
- delegate.rs: propagate signal-based termination as 128+signal on Unix
instead of collapsing to exit code 1.
- github.rs: warn when a skill file fails to download (mirrors Node's
"Could not download" log) instead of skipping silently.
- npm/build-packages.mjs: accept the release `.tgz` artifacts (extract them)
in addition to unpacked binaries, matching build-rust-cli.yml output.
- npm/cct/package.json: add top-level os/cpu so npm rejects unsupported
platforms at install time instead of failing at runtime.
- build-rust-cli.yml: add `permissions: contents: write` (gh-release) and
Swatinem/rust-cache for the 5-target matrix.
- tests/integration.rs: tighten the 2-space-indent assertion.
Not changed (intentional parity with the Node CLI):
- merge.rs new-hook-type copy: Node copies the incoming value as-is for a
previously-absent hook type (no old-format normalization); kept identical.
fmt + clippy clean; 23 offline + 2 network tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(cli-rust): abort install on corrupt existing settings/hook config
Follow-up to the cubic review: a corrupt/unreadable existing settings or
hook file now fails the whole component install (returns 0) instead of
skipping just that location, matching Node — where readJson throws out of
the per-location loop and fails the component. Prevents a multi-location
run from reporting success despite a bad target location.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore(cli-rust): prep v0.1.0 release via GitHub Releases + cargo-binstall
Wire up the two opt-in distribution channels that don't touch the existing
`claude-code-templates` npm package:
- Cargo.toml: fix cargo-binstall pkg-url to the `cli-rust-v<version>` tag
(was `v<version>`), so `cargo binstall --git ...` resolves the release asset.
- install.sh: resolve the latest `cli-rust-v*` release instead of the generic
/releases/latest, which could otherwise pick a Node-CLI `vX.Y.Z` release.
- README: install table now lists the available preview channels (curl|sh,
cargo-binstall via --git, from source) and marks Homebrew/npm as planned;
Release section documents the merge -> tag cli-rust-v0.1.0 -> verify flow.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Integrate NVIDIA's SkillSpector static analyzer (Apache-2.0) to scan
AI agent skills under cli-tool/components/skills/ for security issues
(prompt injection, data exfiltration, supply chain, dangerous code, etc.).
- scripts/skillspector_scan.py: batch orchestrator that discovers skill
dirs (by SKILL.md), runs `skillspector scan --no-llm --format json` on
each, and aggregates results into a Markdown PR report + SARIF log.
Tolerates per-skill scan failures and the CLI's non-zero exit on high
scores without aborting the batch.
- skill-security-scan.yml (PR): scans only changed skills, posts an
idempotent report comment, and blocks on HIGH/CRITICAL (score > 50).
- skill-security-scan-all.yml (weekly + manual): scans all skills,
reports to run summary and SARIF, never blocks.
- CLAUDE.md: document the scanning workflow.
Co-authored-by: Claude <noreply@anthropic.com>
* migrate: Vercel → Cloudflare Pages + Workers para reducir costos ($110 → ~$0-5/mes)
- Cambia adaptador Astro de @astrojs/vercel a @astrojs/cloudflare (mode: 'directory')
- Agrega dashboard/wrangler.toml con nodejs_compat para compatibilidad total
- Crea cloudflare-workers/crons/ Worker que reemplaza los cron jobs de Vercel
(claude-code-check cada 30min, health-check cada 1h en vez de cada 15min)
- Actualiza CI/CD: Vercel CLI → wrangler pages deploy (requiere CLOUDFLARE_API_TOKEN y CLOUDFLARE_ACCOUNT_ID en GitHub Secrets)
- Elimina crons duplicados del proyecto legacy aitmpl (root vercel.json)
- Quick win: agrega Cache-Control headers a components.json (86400s), plugins.json,
trending-data.json y claude-jobs.json para cortar el costo de bandwidth de $53
Próximos pasos manuales (ver PR description):
1. Crear proyecto en Cloudflare Pages
2. Agregar secrets de Cloudflare en GitHub
3. Migrar env vars de Vercel a Cloudflare Dashboard
4. Deployar cloudflare-workers/crons con wrangler
5. Apuntar dominios a Cloudflare Pages
* fix: nodejs_compat_v2 + react-dom/server.node alias para Cloudflare Workers
- Cambia compatibility_flags de nodejs_compat a nodejs_compat_v2
- Agrega alias vite react-dom/server → react-dom/server.node para evitar
MessageChannel error en module init time en Cloudflare Workers runtime
- Agrega ssr.noExternal para bundlear react-dom y aplicar el alias
* fix: revert compatibility_flags a nodejs_compat (estándar)
nodejs_compat_v2 no es el flag primario. El fix real del MessageChannel
error fue el alias vite react-dom/server → react-dom/server.node,
no el cambio de flag.
* fix: inject Cloudflare Pages runtime env into process.env via middleware
Add Astro middleware that copies context.locals.runtime.env (Cloudflare
Pages secrets) into process.env before each request, so API routes can
use process.env.X as a unified pattern without changing the call sites.
Also add || process.env.X fallbacks to all API routes/libs that were
using import.meta.env exclusively (build-time only in Vite).
Verified on staging: track-download-supabase, health-check,
claude-code-check, collections, github/token all return correct responses.
The label should always be re-applied on synchronize events (new commits
after review mean re-review is needed), but the welcome comment should
stay idempotent. Move the label/createLabel logic before the marker
check so `review-pending` is ensured on every run.
https://claude.ai/code/session_016JRD3XpvZag4BGgQsw84uk
Covers the case where a PR is opened without component changes and adds
them in a later commit. Uses a hidden HTML marker in the welcome comment
to detect prior runs and skip re-posting on subsequent synchronize events.
https://claude.ai/code/session_016JRD3XpvZag4BGgQsw84uk
Posts a welcome comment and applies a `review-pending` label when a PR
touches `cli-tool/components/**`. The comment explains the review flow
(audit → maintainer review → merge → catalog regen → live on aitmpl.com)
so contributors know what to expect after submitting.
https://claude.ai/code/session_016JRD3XpvZag4BGgQsw84uk
* enhance: Improve prompt-engineer agent (automated review)
- Fix broken reasoning framework: complete Ordering field and Necessity scale
- Remove OpenAI attribution from description; add invocation example block
- Restrict tools to Read only (text-transformation agent needs no writes)
- Add XML Structure and CoT Opportunity dimensions to reasoning template
- Move meta-instruction NOTE out of output template, place as agent directive
- Fix stray markdown bold markers on Reasoning Before Conclusions guideline
- Integrate orphaned examples bullet into the Examples guideline line
- Add concrete worked example section (classify customer feedback)
Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>
* security: Harden CI/CD and repo for open-source safety
- Add --ignore-scripts to all npm ci/install in CI workflows and predeploy script
- Fix shell injection in discord-release-notification (use env vars + jq for payload)
- Add explicit permissions to all workflows (least privilege principle)
- Add root .npmrc with ignore-scripts=true
- Add .github/dependabot.yml for automated dependency security updates
- Add .github/CODEOWNERS to protect workflows, scripts, and API paths
- Expand .gitignore with *.pem, *.key, credentials.json patterns
* fix: Grant contents:read to deploy workflow so checkout works
Cubic correctly flagged that permissions: {} blocks actions/checkout.
* feat(jobs): add Claude Code jobs section with free scraping pipeline
Add a new Jobs page (/jobs) and homepage preview showing positions that
require Claude Code. The scraper uses only free sources (HN Firebase API,
HN Algolia, RemoteOK, WeWorkRemotely RSS) with no API keys needed.
Runs daily via GitHub Actions alongside existing data updates.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(jobs): address all Cubic review feedback (P1+P2)
P1 fixes:
- Location parser now skips role titles (e.g. "AI-Native Technical Operations Lead")
- Salary extraction filters out funding/revenue amounts ($37M raised)
- applyUrl validated with safeUrl() to prevent javascript: injection
P2 fixes:
- timeAgo() handles NaN/invalid dates gracefully
- WeWorkRemotely IDs use URL slug instead of non-deterministic hash()
- GitHub Action diff check includes dashboard/public/claude-jobs.json
- Remote flag also checks description body for remote indicators
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(jobs): fix mojibake encoding and false salary extraction
- strip_html() now fixes common UTF-8 mojibake patterns (’ → ', â€" → —)
- Salary validation requires k/K suffix or >= $1000 for raw amounts
- Removes false positives: $100-140, $150-300 (ambiguous), $20K (bounty)
- Adds $X/yr pattern for single-value annual salaries
Addresses Cubic review comments #8, #9, #10.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(jobs): add Anthropic Careers source, auth gate, and UI improvements
- Add Greenhouse API collector for Anthropic career listings mentioning Claude Code
- Add Clerk auth gate requiring sign-in to view job links
- Add auth banner with sign-in CTA for unauthenticated users
- Improve description/tag color contrast (#999/#aaa) for dark theme
- Add Anthropic source badge (purple)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(jobs): address Cubic review — avoid unnecessary rerenders and remove candidate cap
- useGlobalAuth: only call setState when values actually change (prevents 500ms rerender loop)
- Remove hard cap of 80 Anthropic candidates to avoid dropping valid Claude Code roles
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Migrate all API endpoints from api/ (Vercel serverless) to dashboard/src/pages/api/ (Astro routes)
- track-download-supabase, track-command-usage, track-installation-outcome, track-website-events
- collections (index, [id], items)
- health-check, claude-code-check, discord/interactions
- Add shared API libs: cors.ts, neon.ts, auth.ts, changelog-parser.ts
- Add @supabase/supabase-js, @neondatabase/serverless, discord-interactions, @clerk/backend deps
- Remove catch-all API proxy ([...path].ts) - APIs are now native Astro routes
- Serve components.json and trending-data.json from dashboard/public/
- Switch to same-origin fetching (relative URLs) for data files
- Add dashboard/vercel.json with crons and CORS headers
- Simplify CI/CD to single deploy target (dashboard project)
- Update deploy script and package.json scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Blog bot: shares random blog article daily at 15:00 UTC
- General bot: posts engagement questions (50 questions pool) at 16:00 UTC
- Community Help bot: posts Claude Code tips/tutorials (42 questions pool) at 17:00 UTC
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Removes broken initial jq block and builds Discord payload entirely
with jq to avoid heredoc variable expansion issues.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Shares a random component from the catalog to Discord daily at 14:00 UTC.
Includes rich embed with type, category, install command, and website link.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Set continue-on-error: true so the security validation workflow
reports issues without failing the overall deployment pipeline.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Replace verbose component listings with concise markdown tables
- Show only top 5 failed components in PR comments
- Add summary table for overall statistics
- Reduce comment size significantly while maintaining key information
- Encourage users to view full report in workflow artifacts for details
https://claude.ai/code/session_01JkCjk0Y2XZxR2DWG8D3hBN
Co-authored-by: Claude <noreply@anthropic.com>
Updated all references to point to new script locations:
- generate_components_json.py → scripts/generate_components_json.py
- generate_trending_data.py → scripts/generate_trending_data.py
Files updated:
- .github/workflows/update-json-data.yml
- CLAUDE.md
- docs/CLAUDE.md
- docs/api/README.md
- docs/guides/growth-kit-pr.md
- cli-tool/src/validation/README.md
This ensures CI/CD workflows and documentation are in sync with the new project structure.
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Runs daily at 3:00 AM UTC
- Generates components.json and trending-data.json
- Auto-commits changes if data is updated
- Can be triggered manually via workflow_dispatch
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Move RELEASE_BODY to environment variable
- Prevents GitHub Actions from interpreting release body content as bash commands
- Safer handling of user-provided content
## Changes Made:
### 1. Modal Text Display Improvements
- Increased error/warning message font size from 14px to 16px for better readability
- Improved line height from 1.5 to 1.6 for better spacing
- Increased margin-bottom from 4px to 8px for better visual separation
### 2. Code Preview Text Wrapping
- Removed horizontal scroll (`overflow-x: auto`) from code previews
- Added `white-space: normal` to prevent excessive whitespace at line start
- Added `word-wrap: break-word` and `overflow-wrap: break-word` for proper text wrapping
- Applied to all code preview sections:
- Error line text previews
- Warning line text previews
- Example line text in errors
- Example line text in warnings
### 3. Line Number Scroll Synchronization
- Added `position: relative` to `.code-body` for better layout control
- Added `overflow: hidden` and `max-height: 600px` to `.code-line-numbers`
- Added `max-height: 600px` to `.code-content`
- Implemented JavaScript scroll sync between line numbers and code content
- Line numbers now scroll perfectly in sync with code content
### 4. Clickable Error Line Numbers
- Added `cursor: pointer` to error/warning line numbers
- Added "Click to see details" tooltip on error/warning lines
- Implemented click event listeners on all error/warning lines
- Click handler searches through validators to find matching error
- Opens validation modal with correct validator details when clicked
- Added hover effects with `transform: translateX(-2px)` and `cursor: help`
## User Experience Improvements:
- ✅ Error messages are now larger and easier to read (16px)
- ✅ Code snippets wrap naturally without horizontal scroll
- ✅ No excessive whitespace at the beginning of code lines
- ✅ Line numbers stay synchronized during scroll
- ✅ Error line numbers are interactive and open detailed validation modals
- ✅ Better visual hierarchy with improved spacing and sizing
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- Remove 4 obsolete tracking workflows:
- analytics-processor.yml (GitHub Issues-based tracking)
- tracking-dispatch.yml (repository dispatch events)
- process-tracking-logs.yml (GitHub Pages log processing)
- simple-tracking.yml (manual workflow dispatch)
- Remove obsolete JSON data file:
- docs/analytics/download-stats.json (workflow-generated data)
- Update WORKFLOWS_REFERENCE.md to reflect current architecture:
- Document only active workflows (deploy, publish-package)
- Replace workflow tracking docs with Supabase integration info
- Add migration history and troubleshooting for new system
The tracking system now uses direct Supabase database integration
from the CLI, eliminating all GitHub Actions dependencies for
analytics. This provides better performance, reliability, and
real-time tracking capabilities.
Remaining workflows handle only deployment and package publishing.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
## GitHub Actions Workflow:
✅ Automatic deployment on push to main branch only
✅ Uses Vercel CLI for production builds
✅ Deploys to aitmpl.com custom domain
✅ Other branches require manual deployment
## Configuration Files:
- - GitHub Actions workflow
- - Setup instructions for secrets
- - Vercel configuration with caching and security headers
## Required GitHub Secrets:
- VERCEL_TOKEN
- VERCEL_ORG_ID
- VERCEL_PROJECT_ID
## Deployment Flow:
🎯 Push to main → Auto-deploy to https://aitmpl.com🔧 Other branches → Manual deployment only
Professional CI/CD pipeline for seamless production deployments.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add automated workflow to publish CLI package to GitHub Packages
- Configure package scoping with @davila7/claude-code-templates
- Include version bumping and automatic GitHub releases
- Add .npmrc for proper registry configuration
- Support both manual triggers and release-based publishing
Package will be available as:
npm install -g @davila7/claude-code-templates --registry=https://npm.pkg.github.com🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Document active vs deprecated workflows
- Provide clear usage instructions for download tracking
- Include troubleshooting guide for workflow conflicts
- Prevent confusion about which workflow to use
Active: simple-tracking.yml (download tracking)
Deprecated: 3 previous tracking attempts
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Mark analytics-processor.yml as DEPRECATED (issues-based approach)
- Mark process-tracking-logs.yml as DEPRECATED (scheduled cron approach)
- Mark tracking-dispatch.yml as DEPRECATED (repository dispatch approach)
- Disable all triggers on deprecated workflows to prevent conflicts
- Add clear documentation that simple-tracking.yml is the ACTIVE workflow
- Keep deprecated files for reference and historical context
Active workflow: simple-tracking.yml (manual triggers + PR creation)
Deprecated workflows: 3 previous attempts with different approaches
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Change workflow to create pull requests for tracking updates
- Maintain repository security by requiring PR review
- Add detailed PR descriptions with component information
- Use GitHub CLI for automated PR creation
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- ✨ Add comprehensive download tracking infrastructure
- 📊 Create detailed analytics dashboard at /download-stats.html
- 🔧 Implement GitHub Actions workflow for stats processing
- 🎨 Add elegant footer link instead of main page widget
- 📈 Support interactive charts with Chart.js integration
- 🔒 Maintain privacy-first approach with anonymous tracking
- 📱 Responsive design for mobile and desktop
- 🚀 Ready for production deployment
Components added:
- GitHub Actions workflow for manual tracking triggers
- Analytics JSON data structure and processing
- Interactive dashboard with doughnut and line charts
- Progress bars and detailed component metrics
- Terminal-style design consistent with site theme
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix last_updated field to use actual timestamp instead of literal string
- Use CURRENT_TIMESTAMP variable with proper command substitution
- Update sample data to reflect recent testing (2 agent downloads)
- Remove single quotes around EOF to allow variable expansion
Daniel Avila