96c3cb0743
fixing ci
2026-03-23 11:09:46 -07:00
2148556d27
adding new skill
2026-03-23 10:51:57 -07:00
eab4da0aba
fixing readme and CI
2026-03-22 15:51:45 -07:00
44d8248160
removing vercel-firewall skill
2026-03-22 14:43:53 -07:00
c2d6e61dd0
Removing Satori
2026-03-22 14:38:33 -07:00
0940ee70c5
removing payments
2026-03-22 14:35:22 -07:00
a9b8bee401
removing geist docs
2026-03-22 14:07:14 -07:00
83dea37473
Removing geist
2026-03-22 14:06:32 -07:00
2fcdd662b3
removing CMS
2026-03-22 14:01:33 -07:00
90b6504628
fixing our skills with a proper engine
2026-03-22 13:48:55 -07:00
ef93bf49ca
fixing template broken builds
2026-03-21 22:01:57 -07:00
aeb71be011
editing status.md for project status
2026-03-18 21:57:14 -07:00
3c50276108
fixing telemetry to be base tracking and anonymous
2026-03-18 10:46:28 -07:00
abd9ed613a
fixing for telemetry
2026-03-18 09:57:56 -07:00
637de60acb
Remove accidental fake-banned-test-skill
2026-03-15 21:24:07 -07:00
34ac109f3b
Rebuild generated manifests after rebase
2026-03-15 21:18:04 -07:00
a2cbc8e45e
fixing and making telemetry more stable
2026-03-15 21:15:20 -07:00
76d6dd11aa
Run codegen
2026-03-13 12:56:41 -07:00
b0240a6696
Remove extra references, prune the skill and narrow down its focus
2026-03-13 12:49:50 -07:00
e7a631ee76
Add vercel-services skill
...
Wire in vercel-services
2026-03-13 12:49:50 -07:00
8e3350454c
feat: prompt scoring improvements, compaction re-injection, validation dedup, strip droppedByCap from context; bump to 0.18.0
...
- Add dominant-topic suppression (top score >= 600 filters scores < 50)
- Add project-context boost (+3 for VERCEL_PLUGIN_LIKELY_SKILLS skills)
- Add lexical fallback floor (reject raw score < 20)
- Add compaction re-injection for priority >= 7 skills (VERCEL_PLUGIN_CONTEXT_COMPACTED)
- Add validation rule dedup tracking (ruleId + filePath on violations)
- Strip droppedByCap from injected HTML comments (kept in debug logs)
- Fix ncc/SKILL.md and next-forge/SKILL.md YAML frontmatter
- Add startup diagnostic for broken skill frontmatter
2026-03-11 19:01:59 -06:00
b7e9b1b053
feat: merge upstream telemetry + Cursor compat, fix tests and dedup migration; bump to 0.17.0
2026-03-11 16:12:55 -06:00
8e24d0694a
feat: add chainTo skill chaining, prompt signals, validation upgrades, and dedup reset on context clear
...
Add a chainTo frontmatter field to skills that triggers follow-up skill injection
when PostToolUse file contents match regex patterns. Add upgradeToSkill/upgradeWhy
fields to validation rules so validate errors can recommend loading a specific skill.
Register posttooluse-bash-chain.mjs in hooks.json. Add ChainToRule interface to
patterns.mts and skill-map-frontmatter.mts, with parseChainToRules() parser. Add
duplicate-key detection to the YAML parser. Reset dedup claim dir and session file
on clear/compact events in session-start-seen-skills so skills re-inject into fresh
context windows.
Add chainTo rules to: agent-browser-verify, agent-browser, ai-elements, ai-gateway,
ai-generation-persistence, ai-sdk, auth, bootstrap, chat-sdk, cms, cron-jobs,
deployments-cicd, email, env-vars, geist, investigation-mode, json-render,
marketplace, micro, ncc, next-forge, nextjs, observability, payments,
react-best-practices, routing-middleware, runtime-cache, satori, shadcn,
sign-in-with-vercel, swr, turbopack, turborepo, v0-dev, vercel-agent, vercel-api,
vercel-cli, vercel-firewall, vercel-flags, vercel-functions, vercel-queues,
vercel-sandbox, vercel-storage, verification, workflow. Add upgradeToSkill to
ai-elements and ai-sdk validate rules. Expand ai-sdk validate messages with
Run Skill() hints. Update nextjs, vercel-storage, runtime-cache, workflow, turborepo
skill bodies.
Add new skills: geistdocs (Geist design system docs), zzz-test-meta-name-mask
(test fixture). Add skills/_chain-audit.md chain coverage audit doc.
Delete .claude-plugin/marketplace.json, .claude-plugin/plugin.json (deprecated),
skills/edge-runtime/SKILL.md (consolidated into vercel-functions).
Add tests: posttooluse-chain.test.ts (4699 lines, chain injection e2e),
ai-sdk-companion.test.ts (181 lines). Expand build-skill-map.test.ts (+335 lines),
validate-rules.test.ts (+936 lines), session-start-seen-skills.test.ts (+74 lines),
skill-map-frontmatter.test.ts (+50 lines), verification-skill.test.ts (+20 lines).
Update build-manifest.ts to emit chainTo rules and upgradeToSkill fields. Rebuild
generated/skill-manifest.json, generated/skill-catalog.md, generated/build-from-skills.manifest.json.
Rebuild all compiled hooks/*.mjs. Update CLAUDE.md lexical prompt default to on.
Update vercel.md ecosystem graph, docs, and cli-reference.
2026-03-11 15:18:35 -06:00
f438cb7313
fix(skills): normalize manifest regex escaping
...
Regenerate the skill manifest so the new micro and deployments-cicd validate rules use the canonical escaping emitted by build:manifest.
The prior shared-index commit captured non-canonical escaping in generated/skill-manifest.json.
Verified: bun run build:manifest
Verified: git diff --cached -- generated/skill-manifest.json shows only the 2 regex escaping normalizations
Swarm-Agent: codex-rules-wave2b
2026-03-11 15:16:21 -06:00
875a9e7d20
test(upgrade-rules): cover skill upgrade validate fixtures
...
Add focused fixture tests for each current upgradeToSkill validate rule.
Each case asserts the positive trigger and the skipIfFileContains path so future SKILL.md changes do not silently break upgrade guidance.
Verified: bun test tests/upgrade-rules.test.ts
How to test: bun test tests/upgrade-rules.test.ts
Swarm-Agent: codex-test-fixtures
2026-03-11 15:16:21 -06:00
a6077bb0c8
feat(skills): add validate upgrades to three skills
...
Add top-level validate blocks to react-best-practices, auth, and routing-middleware so the manifest can recommend SWR, Sign in with Vercel, and Vercel Firewall/WAF when legacy patterns are detected.
Verified: bun run build:manifest
Verified: git diff -- generated/skill-manifest.json shows only these three skills gained validate entries
Swarm-Agent: codex-rules-wave2a
2026-03-11 15:16:21 -06:00
ca89a80912
feat(nextjs): add upgrade validate rules for auth, functions, and caching
...
Add three Next.js validate rules that recommend upgrading legacy auth, Pages Router API routes, and in-memory caches to dedicated Vercel skills.
Regenerate the static skill manifest so the new upgrade metadata is available at runtime; this also syncs a few pre-existing source-of-truth manifest entries that were stale in the generated file.
Verified: bun run build:manifest (isolated clean checkout based on HEAD + skills/nextjs/SKILL.md)
Verified: git diff --cached --check
Swarm-Agent: codex-commit-nextjs
2026-03-11 15:16:21 -06:00
7a124e6561
Add sitemap field to skill metadata: parse metadata.sitemap in skill-map-frontmatter.mts, add sitemap to SkillConfig interface and KNOWN_KEYS, render sitemap URLs in buildDocsBlock() alongside doc links, include sitemap in generated manifest, and add sitemap URLs to 35 SKILL.md files for domains that have sitemap.xml. Also fix 15 broken doc URLs across 14 skills (vercel.com/docs path changes, anthropic docs, stripe, descope, flags-sdk, ai-sdk). Bump to 0.16.1.
2026-03-10 14:31:40 -06:00
17be9898ea
Add sitemap field to SkillConfig and inject sitemap URLs alongside doc links in the docs warning block. For each skill, find the sitemap.xml URL for its primary documentation domain and add it as metadata.sitemap in SKILL.md frontmatter. Update buildDocsBlock() in patterns.mts to render sitemap URLs parenthetically after doc links. Parse and validate the new field in skill-map-frontmatter.mts, include it in the generated manifest via build-manifest.ts, and propagate the type through pretooluse and user-prompt-submit hooks. 35 of 46 skills now have sitemaps (8 skipped: domains without sitemaps). Rebuild hooks and manifest.
2026-03-10 14:29:36 -06:00
5dffded3d5
Replace skill body injection with Skill tool invocation; bump to 0.16.0
...
Instead of injecting full SKILL.md bodies as additionalContext, hooks now
inject "You must run the Skill(<name>) tool." — leveraging the conventional
Skill tool mechanism for context loading.
2026-03-10 12:46:54 -06:00
d5b5ef47f7
Replace skill body injection with Skill tool invocation instructions
...
Instead of injecting the full SKILL.md body as additionalContext, inject
"You must run the Skill(<name>) tool." — a more conventional way of
telling the agent to use the Skill tool for context loading.
2026-03-10 12:46:11 -06:00
ad4127d120
In the ai-sdk and ai-elements skills, make AI Elements mandatory for ALL AI-generated text displayed in browser UIs — remove every escape hatch that lets agents skip it. Specifically: remove the "Without AI Elements (Manual)" section from ai-sdk that teaches raw {text} rendering, scope toTextStreamResponse() guidance to non-browser clients only with explicit warnings against using it to skip AI Elements, strengthen the rendering mandate to say "no exceptions — even for simple prose" because AI SDK models always produce markdown, update the ai-elements "When to Use" table to replace "Optional — may be overkill" with "Yes — models always produce markdown", and add streaming panels/perspectives/summaries to the examples list. Rebuild the manifest.
2026-03-10 12:46:00 -06:00
5948eb1497
Scan every skills/*/SKILL.md file for documentation URLs, HTTP-check each one for 404s, and replace broken links with verified live alternatives. Broken URLs found: vercel.com/docs/marketplace → /docs/integrations, vercel.com/docs/marketplace/sign-in-with-vercel → /docs/sign-in-with-vercel, vercel.com/docs/functions/middleware → /docs/routing-middleware, vercel.com/docs/getting-started → /docs/getting-started-with-vercel, vercel.com/docs/infrastructure/runtime-cache → /docs/runtime-cache, vercel.com/docs/content → /docs/solutions/cms, vercel.com/docs/queues/api-reference → /docs/queues/api, vercel.com/docs/security/secure-backend-access/oidc-federation → /docs/oidc, vercel.com/docs/workflow/flags → /docs/feature-flags, flags-sdk.dev/docs/upgrade-guide → github.com/vercel/flags upgrade-to-v4.md, ai-sdk.dev/docs/reference/types/ui-message → /docs/reference/ai-sdk-core/ui-message, docs.anthropic.com/en/docs/claude-code/agent-tool-use → /sub-agents, docs.descope.com/sdks/nextjs → /getting-started/nextjs, docs.stripe.com/libraries/node → /sdks, vercel.com/blog/ncc → github.com/vercel/ncc. Rebuild manifest. Bump to 0.15.1.
2026-03-10 12:32:09 -06:00
905ffba7fa
feat: add lexical stemmer, prompt signal scoring, docs, and plugin metadata
...
- Add stemmer and shared contractions modules for lexical prompt matching
- Enhance lexical index and prompt patterns with stemming support
- Add promptSignals metadata to all 43 skill frontmatter files
- Add comprehensive documentation site (docs/)
- Add .claude-plugin marketplace and plugin metadata
- Add benchmark scenarios script
- Update skill manifest with prompt signal data
- Add lexical-index and stemmer tests, expand prompt-patterns tests
2026-03-10 03:24:38 -06:00
525258f2d3
feat: add @vercel/sandbox dep and benchmark-sandbox spike
...
Add @vercel/sandbox as a dev dependency for sandbox benchmarking.
Include initial spike scripts and regenerated manifests.
2026-03-09 18:58:11 -06:00
b8b233995c
feat(skills): broaden trigger patterns for 7 under-injected skills based on eval findings; add next-forge skill; bump to 0.15.0
...
Eval analysis of 9 real sessions showed 10 skills never triggering despite being
requested. Root causes: pathPatterns too narrow (agents write to lib/email-template.tsx
not emails/), promptSignals containing regex instead of plain text (vercel-sandbox),
and missing promptSignals entirely (v0-dev, vercel-firewall).
Skills updated: email, vercel-queues, edge-runtime, vercel-firewall, chat-sdk,
v0-dev, vercel-sandbox. New skill: next-forge (bootstrap detection).
2026-03-09 17:56:23 -06:00
0c49abc547
fix(skills): quote YAML validate patterns ending with colon to fix js-yaml parse errors; bump to 0.14.1
2026-03-09 16:38:11 -06:00
92dbe3ae02
feat(hooks): add SubagentStart/SubagentStop hooks for subagent skill injection; bump to 0.14.0
...
- SubagentStart bootstrap hook injects project context (likely skills, summaries) into spawned subagents
with budget scaling by agent type (minimal for Explore/Plan, standard for general-purpose)
- SubagentStop sync hook writes agent metadata to a session-scoped JSONL ledger for observability
- SessionEnd cleanup extended to remove subagent ledger files
- Updated ai-elements/nextjs skills, benchmark-agents and eval skill definitions
2026-03-09 15:52:56 -06:00
f15a7d6889
feat(eval): ai-elements validate rules, broader workflow promptSignals, wider chat pathPatterns; bump to 0.13.0
...
- ai-elements: add PostToolUse validate rules catching raw part.text rendering,
react-markdown, and dangerouslySetInnerHTML — guides agent to use MessageResponse
- ai-elements: add *chat* and *message* wildcard pathPatterns (catches flight-chat.tsx etc.)
- workflow: add 8 phrases for reliability language ("individually reliable",
"retry on transient", "transient failures", etc.)
- workflow: add 7 allOf pairs ([retry, transient], [reliable, retry], [sandbox, reliable], etc.)
2026-03-09 15:17:38 -06:00
5d548e5be8
fix(security): address audit findings — path traversal, brace expansion, injection escaping, profiler hardening; bump to 0.12.0
...
- Validate sessionId in dedupClaimDirPath() to prevent path traversal (HIGH)
- Add brace expansion pre-pass in globToRegex for {ts,js,mjs} patterns (HIGH)
- Escape --> sequences in HTML comment metadata blocks (MEDIUM)
- Harden checkVercelCli/checkAgentBrowser with 3s timeouts, suggest latest version (MEDIUM)
- Replace silent catch {} blocks with debug logging (LOW)
- Add semver-aware version comparison (LOW)
- Update golden snapshots and fix invocationId sharing
2026-03-09 14:18:43 -06:00
f035d9afb3
fix(inject): strip YAML frontmatter from skill bodies before injection; bump to 0.11.1
...
Skill frontmatter (pathPatterns, bashPatterns, promptSignals, etc.)
was being injected alongside the skill body, wasting token budget on
metadata only useful for hook matching. Now uses extractFrontmatter()
to emit only the markdown body.
2026-03-09 13:43:45 -06:00
4ac3929ef0
fix(manifest): rebuild brace-expanded regex sources
...
The PreToolUse hook restores path regexes from generated/skill-manifest.json when a v2 manifest is present, so the brace-expansion fix also needs regenerated pathRegexSources. This refresh updates the affected extension-list patterns from literal brace matches to alternations.
Verified: bun run build:manifest
Verified: bun test tests/pretooluse-skill-inject.test.ts -t "matches src/middleware\.(mjs|mts) to routing-middleware skill"
Swarm-Agent: codex-brace-expand
2026-03-09 13:41:28 -06:00
7ac8edfb8f
feat(skills): aggressive prompt signals for workflow/sandbox, "check the docs" directives across 8 skills; bump to 0.11.0
...
- workflow: add ~60 new promptSignal phrases for reliability language
(survive page reload, fault-tolerant, retry on failure, session
persistence, reconnect, durable chat/agent), human-in-the-loop
patterns (approval, pause until, wait for), and pipeline vocabulary.
Add ~25 new allOf pairs and 12 new anyOf terms.
- vercel-sandbox: add promptSignals from scratch (had none). 33 phrases
covering isolated execution, sandbox environments, code safety,
FFmpeg/media processing, code playgrounds, and tutor patterns.
27 allOf pairs, 8 anyOf terms, noneOf excludes iframe/codesandbox.
- Add "CRITICAL — your training data is outdated" blockquote at the top
of 8 fast-moving skill bodies (workflow, ai-sdk, vercel-sandbox,
ai-gateway, chat-sdk, vercel-flags, vercel-queues, ai-elements)
directing agents to fetch docs before writing code.
Eval results that motivated these changes:
- content-pipeline: 9/10 (workflow triggered, correct WDK patterns)
- customer-support: 3/10 → workflow never injected (now scores 50)
- code-sandbox-tutor: 1/10 → sandbox never injected (now scores 80)
2026-03-09 13:16:16 -06:00
300488ebf3
fix(workflow): add explicit --no-src-dir guidance for create-next-app, update golden fixtures; bump to 0.10.1
2026-03-09 12:55:59 -06:00
5ce557a33e
feat(skills): add ai-generation-persistence and verification skills; bump to 0.10.0
...
New ai-generation-persistence skill (priority 6) injects guidance for treating
AI generations as first-class persistent resources — unique IDs, addressable
URLs, database/Blob storage, cost tracking, and generate-then-redirect UX
patterns. Triggers on AI SDK imports and broad prompt signals.
New verification skill added. Updated ecosystem graph, catalog, manifest,
fixtures, and snapshots.
2026-03-09 12:23:19 -06:00
ff965cc377
fix(skills): remove styled-jsx, regenerate catalog, add investigation-mode skill, build-from-skills templates; bump to 0.9.10
2026-03-09 11:38:08 -06:00
2cbc3d45de
fix(skills): remove styled-jsx skill in favor of shadcn/tailwind
...
styled-jsx is no longer recommended — all CSS-in-JS guidance should
point to shadcn/tailwind and existing solutions instead.
2026-03-09 11:08:23 -06:00
81a6da32f7
fix(ai-sdk): add validate rules for direct openai() model bypass, dall-e-3, and experimental_generateImage; bump to 0.9.9
2026-03-09 08:10:50 -06:00
a43cb60a64
fix(skills): stronger outdated model warnings with "your knowledge is outdated" language, make AI Elements mandatory for AI text rendering; bump to 0.9.8
2026-03-09 07:59:56 -06:00
2ca648a62f
fix(ai-sdk): add PostToolUse validate rules for outdated image models, placeholder images, and removed generateObject; bump to 0.9.7
2026-03-09 00:41:53 -06:00
melkeydev