- api/ was the pre-migration Vercel serverless functions; all endpoints now
live in dashboard/src/pages/api/ (Astro routes on Cloudflare Pages)
- CLAUDE_BACKUP.md was a stale copy of CLAUDE.md from the Vercel era
- package.json: drop 'vercel dev' scripts, broken discord:register (target
file no longer exists), unused @vercel/postgres, discord-interactions and
@vercel/node; package-lock.json regenerated
* Fix unauthenticated command injection (RCE) in Studio server
The `--studio` server (cli-tool/src/sandbox-server.js) bound to 0.0.0.0
with wildcard CORS and no authentication, and passed request-body fields
into spawn(..., { shell: true }). Because shell:true makes Node join the
argv array into a single `sh -c` string, the fields were parsed by the
shell, allowing OS command injection (RCE) via POST /api/execute (prompt)
and POST /api/install-agent (agentName), reachable from the LAN or a
malicious web page (wildcard CORS).
- Remove shell:true from all three spawns so arguments stay discrete argv
entries; shell metacharacters can no longer inject commands.
- Validate agentName against ^[A-Za-z0-9._/-]+$ before use.
- Bind the server to 127.0.0.1 only (removes the LAN vector).
- Restrict CORS to the local UI origin and reject cross-origin requests
(removes the drive-by browser vector).
Fixes GHSA-79wm-x847-7cvg.
Co-Authored-By: Claude Opus <noreply@anthropic.com>
* security: Windows-safe spawns + release bump on top of GHSA-79wm-x847-7cvg fix
Builds on @spartan8806's fix (advisory-fix-1). Adds the two pieces that fix
lacked:
- Resolve npx/claude via their .cmd shims on Windows (NPX_CMD/CLAUDE_CMD).
Without shell:true, bare spawn('npx'/'claude') fails with ENOENT on win32,
which would break agent install/local execution. This keeps the security fix
cross-platform.
- Bump version to 1.29.4 (root + cli-tool package.json) and add the 1.29.4
Security entry to CHANGELOG for the patched release.
Refs GHSA-79wm-x847-7cvg.
---------
Co-authored-by: spartan8806 <spartan8806@users.noreply.github.com>
Co-authored-by: Claude Opus <noreply@anthropic.com>
Co-authored-by: Dani <dan.avila7@gmail.com>
cli-tool/src/analytics.js and others require('../package.json') which
resolves to cli-tool/package.json — must be bundled in the npm package.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CLI fails with MODULE_NOT_FOUND because root package.json was missing
these deps that cli-tool/src/index.js requires.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Package was 413 too large due to dashboard/public/component-content/.
Only cli-tool/bin, cli-tool/src, cli-tool/components/sandbox, and README needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Migrate all API endpoints from api/ (Vercel serverless) to dashboard/src/pages/api/ (Astro routes)
- track-download-supabase, track-command-usage, track-installation-outcome, track-website-events
- collections (index, [id], items)
- health-check, claude-code-check, discord/interactions
- Add shared API libs: cors.ts, neon.ts, auth.ts, changelog-parser.ts
- Add @supabase/supabase-js, @neondatabase/serverless, discord-interactions, @clerk/backend deps
- Remove catch-all API proxy ([...path].ts) - APIs are now native Astro routes
- Serve components.json and trending-data.json from dashboard/public/
- Switch to same-origin fetching (relative URLs) for data files
- Add dashboard/vercel.json with crons and CORS headers
- Simplify CI/CD to single deploy target (dashboard project)
- Update deploy script and package.json scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Updated hackathon-ai-strategist agent description and added tools for improved functionality.
- Revised llms-maintainer agent for proactive updates and enhanced tools.
- Introduced new model-evaluator agent for comprehensive AI model assessment and benchmarking.
- Enhanced prompt-engineer agent description for clarity on usage.
- Updated task-decomposition-expert agent to emphasize complex goal breakdown and tool selection.
- Expanded graphql-architect agent with detailed schema design and resolver optimization strategies.
- Created graphql-performance-optimizer agent for performance analysis and optimization of GraphQL APIs.
- Developed graphql-security-specialist agent focusing on security audits, authorization, and protection against vulnerabilities.
- Added security-auditor script to package.json for automated security audits.
Implements a comprehensive download tracking system inspired by npm analytics
to monitor component usage and improve popular components.
Key features:
• Anonymous download tracking for all component types (agents, commands, mcps, settings, hooks)
• Vercel + PostgreSQL backend with dual endpoint strategy
• Privacy-first design with complete opt-out support
• Fire-and-forget tracking that never blocks user experience
• Comprehensive test suite and documentation
Backend changes:
• Created API endpoint /api/track-download.js with PostgreSQL integration
• Implemented proper database schema with download_stats aggregation
• Added request validation, rate limiting, and security measures
• Configured Vercel deployment with database functions
CLI changes:
• Enhanced TrackingService to support database + telemetry endpoints
• Added automatic tracking for all installation types
• Implemented graceful fallback when database is unavailable
• Maintains existing privacy and opt-out mechanisms
Testing & Documentation:
• Added comprehensive test suite (test-download-tracking.js)
• Created detailed documentation (DOWNLOAD_TRACKING.md)
• Included deployment instructions and troubleshooting guide
• Added security and compliance information
The system respects user privacy by:
- Only collecting anonymous usage metrics
- Providing multiple opt-out mechanisms (CCT_NO_TRACKING, CCT_NO_ANALYTICS, CI=true)
- Never storing personally identifiable information
- Using fire-and-forget requests with timeout limits
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Dani