* Add tech-debt skill; bump version to 3.7.0
- New two-mode routed skill (prevent during change / triage backlog)
- Bundles jnsahaj/zero-tech-debt + anthropics/tech-debt stances
- sync-plugins.sh propagated 3.7.0 to all 143 manifests
* Add unknowns-discovery plugin (Claude port from suedzucker-codex-plugins)
Port the unknowns-discovery skill from the suedzucker-codex-plugins Codex
plugin into the Claude Code plugin format. Claude manifest is source of
truth; Codex manifest and both marketplace entries are derived via the
repo's existing generate-marketplace.sh / sync-plugins.sh tooling.
Adaptations:
- SKILL.md frontmatter description trimmed 341 -> 150 chars (sync-plugins.sh
skips single-skill plugins whose description exceeds 250 chars).
- 3 slash commands get name: unknowns-discovery:<cmd> frontmatter and drop
the Codex $unknowns-discovery token; $ARGUMENTS and allowed-tools kept.
- README rewritten for Claude/Codex install; auto-trigger keywords preserved.
- 7 references, 12 templates, 4 examples, 2 scripts copied verbatim.
- Codex-only files dropped (.codex-plugin/plugin.json regenerated,
agents/openai.yaml x2, assets/*.svg) — no icon support on the Claude side.
Also sync package.json 3.6.3 -> 3.7.0 to match marketplace + plugins
(the bump scripts don't touch package.json; resolves a pre-existing drift).
Plugin count: 143 -> 144. All versions held at 3.7.0.
Add .codex-plugin/plugin.json manifests for every plugin (derived from
.claude-plugin/ manifests) and .agents/plugins/marketplace.json (Codex's
standard marketplace location). Codex CLI users can now install plugins
natively via Added marketplace `claude-skills` from https://github.com/secondsky/claude-skills.git.
Installed marketplace root: /Users/eddie/.codex/.tmp/marketplaces/claude-skills.
New files:
- scripts/generate-codex-manifests.sh — derives Codex manifests from Claude
manifests (Claude remains source of truth)
- schemas/codex-plugin.schema.json + codex-marketplace.schema.json — AJV
validation for generated Codex artifacts
- 142 × .codex-plugin/plugin.json — one per plugin
- .agents/plugins/marketplace.json — Codex marketplace catalog
Changed:
- scripts/sync-plugins.sh — syncs .codex-plugin/ version in lockstep pass
- scripts/generate-marketplace.sh — calls generate-codex-manifests.sh after
regenerating the Claude marketplace
- scripts/validate-json-schemas.sh — validates Codex schemas alongside Claude
- package.json — added validate:codex + generate:codex scripts
- README/CHANGELOG/CLAUDE.md/PROJECT_STRUCTURE.md — Codex CLI now ✅ Native
- Version bump 3.6.2 → 3.6.3 (all 142 plugins + both marketplaces + package.json)
Not carried into Codex: commands/ and agents/ arrays (no Codex equivalent;
use Codex /import for that). mcpServers carried through where present (3 nuxt
plugins).
Fixes stale delegate-my-work/.codex-plugin/plugin.json (was 3.4.0).
* fix(codeql): resolve parse-error diagnostics (JSDoc premature close + .vue.ts)
Two root causes for the ~49 parse errors + 291 truncated diagnostics in the
CodeQL run:
1. JSX-comment-inside-JSDoc: 6 .tsx template files used '{/* ... */}' syntax
inside /** ... */ doc-comment blocks. The '*/' in the JSX comment closes the
outer JSDoc block prematurely, so everything after is parsed as real code at
module scope -> cascade of 'Declaration or statement expected' errors.
Fixed by converting the inline notes to parenthetical prose (preserves the
teaching intent, no premature close).
- plugins/base-ui-react/.../Accordion.tsx (was 32 errors)
- plugins/base-ui-react/.../NumberField.tsx (was 17 errors)
- plugins/base-ui-react/.../Popover.tsx
- plugins/base-ui-react/.../Select.tsx
- plugins/base-ui-react/.../Tooltip.tsx
- plugins/motion/.../layout-transitions.tsx
2. .vue transpile artifacts: autobuild compiles .vue SFCs to intermediate
.vue.ts files that the TypeScript extractor can't parse. Added paths_exclude
for '**/*.vue.ts' in codeql.yml. The .vue sources themselves aren't directly
analyzable by CodeQL either, so excluding the artifacts loses no real
coverage.
* fix(codeql): resolve remaining parse errors (8 more files)
Follow-up to the initial parse-error fix. The first CodeQL run after PR #81
showed 8 more files with parse errors that the initial grep missed (my pattern
only caught JSX-comment syntax, not the broader '*/ inside block comment' class
plus real syntax defects).
Premature-close class (5 files):
- multiple-crons.ts: cron expressions '*/5' and '*/6' inside JSDoc close the
block early. Rewrote comment to describe schedules in prose.
- route-handler-api.ts: 'app/api/*/route.ts' path inside JSDoc. Changed to
'app/api/[segment]/route.ts'.
- wasm-worker.ts: '**/*.wasm' glob inside /* */ JSON block. Converted the block
to // line comments (which don't have the premature-close problem).
- remix-integration.tsx: '{/* ... */}' inside a /* */ example block. Converted
the example to // line comments.
Real syntax defects CodeQL surfaced (3 files):
- rpc-client.ts: file contains JSX (a React component) but was named .ts.
Renamed to rpc-client.tsx; updated the one SKILL.md reference.
- turnstile-react-component.tsx: 'useT turnstileSiteKey' typo (space in
identifier) — call sites already used the correct 'useTurnstileSiteKey', so
this was a real ReferenceError waiting to happen.
- queues-dlq-pattern.ts: 'storeFailed Message' typo (space in identifier); the
function is defined correctly as 'storeFailedMessage' elsewhere.
- worker-trigger.ts: '...params: "any"' spread in an object literal value
position is invalid JS. Removed the spread.
* fix(codeql): resolve last 2 parse-error files + self-inflicted comment
- multiple-crons.ts: the previous fix's explanatory comment contained the
literal '"*/" sequence' text, which itself prematurely closed the JSDoc
block. Rewrote to avoid the literal sequence ('star-slash-N' prose instead).
- server-validation.ts: like rpc-client.ts, contains JSX (a React form) but
was named .ts. Renamed to server-validation.tsx; updated 3 references in
README.md and SKILL.md.
* fix(codeql): rename default-query-function.ts → .tsx (JSX in .ts, last 4 errors)
Same root cause as rpc-client.ts and server-validation.ts: the file contains
JSX (<QueryClientProvider>) but was named .ts. Updated 2 references in SKILL.md
and examples/README.md.
* fix(codeql): use documented 'paths-ignore' key, not 'paths_exclude'
The CodeQL config schema's documented key for excluding paths is 'paths-ignore'
(see GitHub CodeQL docs), not 'paths_exclude'. The undocumented key was silently
ignored, so the '**/*.vue.ts' exclusion never actually applied — the drop in
.vue.ts mentions in the logs came from the template fixes, not this config.
Keeping the same exclusion pattern, just under the correct key.
Lockstep version bump (repo convention): package.json, all 142 plugin.json, and all 142 marketplace.json entries -> 3.6.1.
- README: accurate per-harness marketplace support table (Claude Code + ZCode native; Codex CLI + Cursor adaptation needed; opencode + Gemini CLI no marketplace); new 'Installing with skills.sh' section with verified npx skills examples and a security-scanning caveat.
- Removed dead scripts scripts/install-skill.sh and scripts/install-all.sh (targeted non-existent skills/ dir); updated 30 docs/plugins referencing them to use /plugin install (Claude Code) or npx skills add (cross-harness).
- Fixed skill-count inconsistency (139 -> 142 standardized; categories table updated).
- Fixed generate-marketplace.sh bug: hardcoded metadata.version=3.5.0 in heredoc reset the marketplace version on every regen; now syncs from plugin entries.
- Security-audit findings D-001, D-002, D-016, D-019, D-020 marked resolved (install scripts removed).
Lockstep version bump (repo convention): package.json, all 142 plugin.json,
and all 142 marketplace.json entries 3.5.0 -> 3.6.0. Documents the exhaustive
dependency-version audit and stale-instruction fixes from this branch in
CHANGELOG.md, and updates the README version line.
See CHANGELOG.md [3.6.0] entry for the full breakdown: 67/142 plugins
updated, version alignment across Cloudflare/Bun/Next.js/TanStack/Nuxt/
hono/drizzle/better-auth/Hugo/WP/UI skills, Zod 3->4 and Tailwind v3->v4
instruction fixes, Cloudflare node_compat->nodejs_compat, Next 16
middleware->proxy (with OpenNext caveat), CI hardening, and the broken
gitleaks hook / audit-script repairs.
- vitest-testing: note that --reporter=verbose prints a flat list in Vitest 2+ (use --reporter=tree for the hierarchy)
- motion: Cloudflare Workers bullet no longer frames framer-motion as the active recommendation (motion v12.43+ works on Workers)
- base-ui-react: description 'v1.0 beta issues' -> 'v1.0 rc / pre-GA issues' to match the rc.0 body
Defense-in-depth fixes across 8 plugin scripts:
D-008 (High) scaffold-plugin.sh: validate PLUGIN_SLUG against WordPress
slug convention ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ to block path traversal
and sed-injection via untrusted read -p input. Add canonical-path check
asserting DEST_DIR resolves strictly under $HOME/wp-content/plugins/.
Switch all sed substitutions to | delimiter for belt-and-suspenders.
D-007 (High) migrate-radix-component.sh: make idempotent. Before taking
a new .radix-backup, move any existing one aside to
.radix-backup.<timestamp> so the truly-original state survives multiple
runs. Guard the TODO-marker prepend with grep so it isn't stacked on
re-runs.
D-011 (Medium) init-auto-animate.sh: remove the misleading stale
vite.config.ts.backup created by a code path that never edits the file;
the change requires knowing the user's existing vite config shape, so
keep the manual-step instructions and document why no automated edit.
D-012 (Medium) init-nuxt-seo.sh + setup-nuxt-content.sh: replace the
'sed -i.tmp ... && rm' chained pattern (which leaks .tmp on failure)
with a script-global CONFIG_FILE tracked by an EXIT trap that always
removes the tempfile. Promote to set -euo pipefail.
D-013 (Medium) gemini-cli install scripts: add install_file() helper
that backs up any pre-existing destination differing from source to
<dst>.bak.<timestamp> before overwriting, so user customizations in
~/.local/bin and ~/.claude/commands are no longer silently clobbered.
D-017 (Medium) setup-existing-project.sh: the if [ ! -f X ] then cat > X
pattern has a benign TOCTOU race; document that it is accepted because
content is static and concurrent runs would write identical bytes.
- Move embedded keyword lists from description folded scalars to metadata.keywords YAML lists
- Add scripts/extract-keywords.rb for keyword extraction with --dry-run support
- Add CI guardrail in validate-frontmatter.yml to prevent Keywords in description on PRs
- All 211 skills pass frontmatter validation (0 failures)
- Addresses issue #60 / PR #61 (already fixed YAML parse errors, now structural cleanup)
Fixes#60
62/211 skills had YAML frontmatter that failed to parse, causing Claude
Code to silently drop all metadata at runtime. Affected skills would
never auto-trigger based on user input.
Two failure patterns fixed:
- Pattern A (60 files): multiline description with indented Keywords
continuation converted to YAML folded block scalar (>-)
- Pattern A variant (17 files): single-line description with colons
wrapped in double quotes
- Pattern B (1 file): inconsistent keyword list indentation in
tanstack-start normalized to consistent 4-space indent
Added YAML parse check to validate-frontmatter.sh using Ruby
YAML.safe_load to catch syntax errors that grep/awk structural
checks could not detect. Existing CI workflow already runs this
script on PRs and pushes.
Verification: 211/211 skills pass validation with 0 failures.
- Move SKILL.md files from root to skills/<plugin-name>/ subdirectories
- Update all 169 plugins to match official plugin-structure pattern
- Fix marketplace generation script to find SKILL.md in new location
- Update CLAUDE.md documentation with correct structure
- Update skill templates to match new pattern
Per official plugin-dev:plugin-structure skill:
- Skills MUST be in skills/ subdirectory for auto-discovery
- Each plugin has skills/<name>/SKILL.md structure
- This enables Claude Code to automatically discover and load skills
Fixes skill discovery issue where plugins showed as 'installed' but
skills didn't appear in system prompt.
Migration script: scripts/migrate-plugin-structure.sh
Migrated: 167 plugins successfully (2 already migrated)
Total: 169 skills now discoverable
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
BREAKING CHANGE: All plugin paths changed from nested to flat structure
Problem:
- Only 11 out of 169 skills appeared in Claude Code's system prompt
- v3.1.0 updated marketplace.json but didn't migrate directory structure
- Mismatch: marketplace expected `./plugins/skill-name` but files were at
`./plugins/category/skills/skill-name`
Solution:
- Moved all 169 skills from `plugins/*/skills/*` to `plugins/*` (flat)
- Removed 66 empty category directories (api, cloudflare, testing, etc.)
- Updated marketplace.json with correct flat paths (all 169 entries)
- Updated scripts to work with flat structure:
- generate-marketplace.sh: removed nested loop logic
- sync-plugins.sh: simplified to single loop
- Added flatten-plugin-structure.sh migration tool
Migration Details:
- Used git mv to preserve history for all 169 skills
- Handled name collisions via temporary directories
- Validated: 0 errors, 169 skills successfully migrated
Results:
- ✅ All 169 skills at `plugins/*/` level
- ✅ marketplace.json: 169 valid entries
- ✅ No nested skills/ directories remain
- ✅ Scripts updated and tested
This completes the migration started in v3.1.0 (commit 677abf8) and
resolves skill discovery issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Eddie