* [vercel-functions] Add long-duration, large functions, and Docker; harden anti-Edge guidance
The skill had no coverage of several shipped Functions features, and carried
stale numbers that produced actively wrong advice.
New sections:
- Duration and Long-Duration Functions — per-plan table, extended max duration
beta (1800s) with its real constraints: per-function config only, supported
runtime versions, no Secure Compute/Static IPs, HTTP/1.1 idle-connection
caveat and the heartbeat workaround, getDeadline(), and when to use Workflow.
- Large Functions — 250 MB / 500 MB Python standard limits, the 5 GB beta and
VERCEL_SUPPORT_LARGE_FUNCTIONS opt-in, bundle trimming, and the separate
4.5 MB payload cap that gets confused with it.
- Docker and Container Images — Dockerfile.vercel, PORT, scale-to-zero, the
30s SIGTERM grace period, per-instance log broadcast, Services with
runtime: "container", VCR limits/pricing, and when not to containerize.
- Plan Limits at a Glance, with a "What changed for Hobby" note: duration went
60s -> 300s for both default and max, and Basic CPU was replaced by Standard.
Anti-Edge guidance is now prescriptive rather than advisory. "Rule #1: Node.js,
never Edge" leads the skill with a directive to remove runtime = 'edge' on
sight, a table answering each reason people reach for Edge, what Edge actually
costs, and a migration recipe. A new validate rule flags runtime = 'edge' /
"runtime": "edge" as an error, and the runtime-selection table and diagnostics
trees no longer recommend Edge anywhere.
Corrections to existing content:
- Hobby max duration was listed as 10s; it is 300s.
- waitUntil was shown taking a callback. It takes a Promise — the documented
form silently did nothing.
- memory was shown in vercel.json and in the OOM diagnostic; it cannot be set
there (build warning) and is dashboard-only, Pro/Enterprise only.
- Request bodies were listed as 100 MB; the documented cap is 4.5 MB.
- 5 GB bundles were stated unconditionally; they require the opt-in beta.
- Edge was described as a 25s hard limit; it is 25s to first byte, then up to
300s of streaming.
- now.json removal was written in the future tense with a date now past.
Also adds a summary field so the skill degrades to a short summary instead of
being dropped entirely when it exceeds the injection budget, plus path/bash/
prompt signals for Dockerfile.vercel, vercel.ts, vercel vcr, and duration and
bundle-size phrasing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Malte Ubl <89679+cramforce@users.noreply.github.com>
* Correct the vercel.json memory claim
Two problems with the previous wording, both flagged in review:
"and is ignored" was not documented anywhere. The memory docs say only that
setting it produces a build-time warning; whether the value is then discarded
is not stated. Removed the invented consequence.
"NOT settable in vercel.json" dropped a real qualifier. The vercel.json
reference scopes it: "Memory cannot be set in vercel.json with Fluid compute
enabled." The memory key remains valid for legacy non-Fluid deployments, which
is why /docs/functions/configuring-functions/advanced-configuration still shows
"memory": 3009 examples. Restored the Fluid qualifier in all four places and
noted why older examples exist, so the skill doesn't read as contradicting
Vercel's own docs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Malte Ubl <89679+cramforce@users.noreply.github.com>
* Soften anti-Edge guidance to a strong recommendation; drop AWS mention
The Edge guidance was written as a prohibition. Reframed as a strong default
while keeping the one genuinely hard constraint — Next.js 16.3+ doesn't support
runtime = 'edge', so migration is required there and only there.
- Heading: "Rule #1: Node.js, never Edge" -> "Prefer Node.js over the Edge
runtime" (all three internal anchors updated).
- "Do not write it, do not suggest it, remove it on sight" -> prefer Node.js in
new code, recommend migrating when found; a tested reason to stay on Edge is
a legitimate call to make deliberately.
- validate rule severity: error -> recommended. Existing Edge functions still
work, so this is a nudge rather than a blocker. Message reworded to match.
- Migration section now says it's worth doing when already touching the file,
and required on Next.js 16.3+ — not an emergency otherwise.
- vercel.json's runtime: "edge" moved out of the "cannot put here" list, since
it is accepted; it's now a preference note.
- Diagnostics: "Correct fix: delete" -> "Recommended fix: drop"; "Do NOT fix
this by moving to Edge" -> "Moving to the Edge runtime is not the fix".
- "Edge (legacy — do not choose this)" -> "(legacy — not recommended)".
Also removes the infrastructure-provider attribution from the 250 MB bundle
limit, and drops a redundant sentence from the long-function cost note.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Malte Ubl <89679+cramforce@users.noreply.github.com>
---------
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Malte Ubl <89679+cramforce@users.noreply.github.com>
* [vercel-sandbox] rewrite skill as a comprehensive general Sandbox guide
The published skill was a stale browser-automation recipe: it installed
packages with dnf on Amazon Linux (the default image is Ubuntu/apt) and
omitted persistence, regions, images, drives, network policy, credential
brokering, multi-agent, the CLI, and limits. Agents loading it were steered
wrong on the basics.
Rewrite skills/vercel-sandbox/upstream/SKILL.md into a full general Sandbox
skill covering the create/run/stop loop, auth, all create options, commands
(no shell, exit-code semantics), files, apt packages, ports and preview URLs,
persistence/sessions/hooks, snapshots, images, drives, network policy and
credential brokering, running AI agents via the AI Gateway, multi-agent
isolation, the CLI, limits, and a best-practice checklist. Add a summary
field to overlay.yaml as the injection-budget fallback.
Every claim is mapped to a vercel.com/docs/sandbox source or a live probe;
key runtime behaviors (non-zero exit does not throw, timeout rejects in
flight, default user is ubuntu) are BEHAVIOR_CONFIRMED against @vercel/sandbox
3.1.0. Regenerated skill build output and manifest.
* [vercel-sandbox] bump plugin version to 0.49.2
Skill content ships to users via a version bump (per #171). Bump the source
version in package.json and .claude-plugin/plugin.json, sync the per-harness
manifests (.cursor-plugin, .kimi-plugin, .plugin) and the telemetry hook
fallback, and regenerate build outputs. Addresses review feedback.
* adding skill invocation for plugin
* Address review: namespace allowlist, skill:injected, harness tagging
- Only accept skills under the plugin's own namespaces (vercel, vercel-plugin);
other-plugin:deploy, netlify:deploy, and bare slugs are dropped
- Emit skill:injected from the opt-in inject hooks via the same detached sender
- Persist the detected harness per session and attach plugin:agent_harness to
every skill event batch
- Fix normalizeDetectedAgentHarness for AI_AGENT-style names
(claude-code_<version>_agent was reporting as "other")
- Accept Cursor-shaped payloads (conversation_id) through compat normalizeInput
- Disable telemetry for the whole test suite via bunfig preload so hook tests
never phone home
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* [skills] Refresh the AI Gateway skill
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Add AI Gateway CLI inventory, fixtures, and coding-agent validation
- Add a Vercel CLI inventory table to the ai-gateway skill covering
api-keys, budgets, budget defaults, models, routing rules,
coding-agents setup, and leaderboard
- Add a validate rule for the Claude Code footgun: ANTHROPIC_BASE_URL
pointed at AI Gateway requires ANTHROPIC_API_KEY empty with the
gateway key in ANTHROPIC_AUTH_TOKEN
- Add pattern fixtures for vercel ai-gateway commands and
@ai-sdk/gateway installs
- Bump plugin version to 0.48.2
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Cover AI Gateway dashboard and API surfaces added since refresh
- Model discovery documents the live /v1/models fields (type,
modalities, tags, pricing, zdr/no_training) and the per-endpoint
response (has_zdr, has_no_training, full and regional pricing,
live uptime/latency/throughput), with a tested jq filter example
- Add service tiers, fast mode, model filtering (has), safety
identifiers, and virtual model configs to the routing reference
- Add Usage & Billing endpoints (GET /v1/credits, GET /v1/generation)
and generation ID capture to the spend reference
- Correct the pricing claim: some models price below provider list
for every team, and volume discounts exist
- Correct spend alert recipients (owners and Billing role for team
and project budgets) and document spend attribution plus the
AI Gateway Budget Manager permission
- Note project-scoped Logs and CSV/JSON export, per-agent setup
pages for coding agents, and the rules REST endpoints
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Document reasoning across providers and API formats
- Add a reasoning section to the routing reference: discovery through
the model's reasoning_options field, per-format parameters (AI SDK
top-level reasoning, Chat Completions/Responses reasoning object,
Anthropic thinking), cross-format effort and budget mapping, and
per-provider usage reporting differences
- Call out the precedence footgun: providerOptions reasoning entries
fully override the top-level reasoning option and are never merged
- Add the invariant to SKILL.md plus retrieval intent and prompt
signal coverage
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Document tool calling across API formats
- Add a tools section to the routing reference: discovery through the
tool-use tag and supported_parameters, cross-format translation of
tool schemas to the serving provider, per-format entry points, and
web search as a built-in tool
- Add retrieval intent and prompt signal coverage
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Document structured outputs and file attachments
- Structured outputs: json_schema response_format across formats,
legacy json form, streaming accumulation, per-format pages
- File attachments: content-part arrays, image_url and file parts,
discovery through modalities.input and vision/file-input tags
- Retrieval intents and prompt signals for both
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Link the AI Gateway rate limits page from the 429 row
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Link the AI Gateway FAQ page
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Drop transcript capture from the observability reference
Content capture is not public yet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [skills] Address R-Taneja's review nits
- Single-quote the chainTo pattern scalar so spec-strict YAML parsers
accept it
- Make the BYOK skip case-insensitive and let other keys precede
gateway in providerOptions
- Use exact-match index() instead of array contains() in the jq
example; verified it returns the same 76 models against the live
catalog
- Separate CLI-configured agents from first-party-provider agents in
the coding-agents reference so OpenCode and Pi no longer appear on
both sides
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* [hooks] Unpin the telemetry test's plugin version and rebuild
The test asserted the literal 0.48.1 while the built hook inlines the
version from package.json at build time, so any version bump fails CI
with a green local run (the local build goes stale silently). The test
now reads .plugin/plugin.json, and hooks/telemetry.mjs is rebuilt for
0.48.2.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* adding plugin telemetry
* adding kimi and grok detection logic
* upticking version
* fixing headers
* adding harness calls
* fixing installing-id
* fixing detect agent logic to include more
* fixing await to not block other calls
* Add Vercel Services skill
* Prepare Services skill release; bump to 0.47.0
* Reframe Services skill around coupled-components use case
Lead with when Services is the right call (tightly coupled frontend +
backend in one project) and its concrete benefits: skew protection,
synced previews, atomic deploys and rollbacks, private bindings. The
separate-projects escape hatch is now about independent deploy cadence.
Drop framework pinning from examples, add /api namespace-split guidance
(SPA vs frameworks with their own API routes), prefix stripping via
service-scoped rewrite, SPA catch-all to /index.html, and a subdomain
section with the preview-environment caveat.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Make :path prefix capture optional so bare /api matches
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Warn against destination.path instead of teaching it
The proxy only reads destination.service when dispatching into a
service; the path field is compiled and validated but never consumed
at request time.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Spell out the private-by-default rule for services
No top-level rewrite means a service is unreachable from the public
internet and only accessible through bindings; adding a rewrite makes
it public regardless of bindings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Drop frontend from the backend+vercel prompt signal group
Review feedback: the frontend term made the group miss backend-led
phrasings. The wider [backend, vercel] group can reach the threshold
with anyOf hits, which we accept for now.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Rework retrieval intents and examples
Intents: one line per job the skill teaches, anchored by domain
vocabulary (services, binding, rewrites, vercel.json) rather than
product-name prefixes, and covering the private-by-default, subdomain,
and prefix-stripping content added in this PR.
Examples: verbatim-style prompts carrying stack names (FastAPI, Vite,
Express, Go) and symptom phrasings, which is what the lowest-weight
retrieval field is for.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Remove 'frontend' option from skill manifest
Removed 'frontend' from the 'anyOf' array in skill manifest.
* Drop frontend from anyOf in skill source, not just the manifest
The manifest is generated from SKILL.md, so removing the term only
from generated/skill-manifest.json left the two out of sync and
failed the manifest check.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Remove the internal ppr_state proxy values (page/shell/blocking) from the
PPR state table and present the three states by their user-facing category:
Static, Partial, and Dynamic.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Mirrors the cacheReason treatment: ppr_state in the description, prompt
signals (ppr state / ppr_state / x-vercel-ppr-state), retrieval alias +
entity, and a PPR state concept table (page/shell/blocking -> Static/
Partial/Dynamic) next to the cache-reason section. Regenerated manifests.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* [skills] Add cache-reason skill for per-request cache reason debugging
Adds a `cache-reason` skill that explains the per-request `cacheReason`
field (cold, collapsed, error, draft_mode, prerender_bypass, crawler,
stale_time, stale_tag, stale_error) — why a single request was a MISS,
STALE, or BYPASS. Complements `cdn-caching`, which covers aggregate hit
rate and ISR cost via `vercel metrics`.
Written for the public audience: all observation paths route through the
dashboard Logs "Reason" row and `vercel logs --json`. The internal-only
`x-vercel-cache-reason` response header (gated behind is_timing_header_visible)
is explicitly flagged as not user-visible, and the skill avoids the
not-yet-published /docs/caching/cache-status anchors.
- New: skills/cache-reason/SKILL.md (with promptSignals + retrieval block)
- vercel.md: graph reference in the caching section
- README.md: skills table row + count
- cdn-caching: mutual cross-link
- Regenerated skill-manifest.json, skill-catalog.md, build-from-skills.manifest.json
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Merge cache-reason guidance into cdn-caching instead of a new skill
Fold the per-request cacheReason content into the existing cdn-caching
skill (from #108) rather than shipping a separate cache-reason skill:
- cdn-caching: add the 9-value cacheReason table (cold, collapsed, error,
draft_mode, prerender_bypass, crawler, stale_time, stale_tag, stale_error)
refining the x-vercel-cache status, the MISS→BYPASS displayed-status rule,
and how to read cacheReason via `vercel logs --json` / the Logs "Reason"
row (with the internal-only x-vercel-cache-reason header caveat).
- Absorb cache-reason prompt signals + add a retrieval block so questions
like "why is my page stale" / "what does stale_tag mean" route here.
- Remove skills/cache-reason/ and revert its README/vercel.md wiring
(back to 30 skills).
- Regenerate manifest, catalog, build-from-skills manifest.
Verified: 899 tests pass; the real UserPromptSubmit hook injects cdn-caching
for the three cache-reason prompts and correctly ignores unrelated prompts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Tighten cdn-caching cacheReason merge (287→133 lines)
Condense the skill while keeping all 6 cache statuses and all 9 cache
reasons (3 MISS: cold/collapsed/error, 3 BYPASS: draft_mode/
prerender_bypass/crawler, 3 STALE: stale_time/stale_tag/stale_error).
Cut verbose prose, repeated metrics examples, and the FAQ; keep the two
reference tables, the core metrics/logs investigation commands, and the
cacheReason observation guidance. Add [cache, miss] prompt signal so
MISS questions trigger.
Verified: 899 tests pass; the real UserPromptSubmit hook injects
cdn-caching for MISS/STALE/BYPASS/hit-rate prompts and ignores unrelated
and generic-error prompts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Complete cacheReason retrieval entities (add error, collapsed, stale_time)
The retrieval.entities list included some cache reasons but omitted
`error` (and `collapsed`, `stale_time`), making it inconsistent with the
canonical 9-reason table. List all nine reason slugs, ordered to mirror
the table.
Low-risk: the "error" token was already in the lexical index via
stale_error, and injection is gated on exact score — verified generic
error prompts ("fix this null pointer error", etc.) still inject nothing,
while MISS/STALE/BYPASS/hit-rate prompts still route to cdn-caching.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Restore docs/caching/cdn-cache link dropped during trim
The cdn-cache docs URL was inadvertently removed while tightening the
docs list; it's the canonical CDN-cache reference for this skill. Restore
it alongside the caching overview, ISR, metrics, and logs links.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Redo cacheReason as a small additive change to cdn-caching
Prior commits had rewritten (gutted) the existing cdn-caching skill.
Restore the original #108 skill verbatim and add only what's needed:
- A 9-row cacheReason table under Key concepts (3 MISS: cold/collapsed/
error, 3 BYPASS: draft_mode/prerender_bypass/crawler, 3 STALE:
stale_time/stale_tag/stale_error), the MISS→BYPASS displayed-status
rule, and how to read cacheReason (vercel logs / Logs panel; the
x-vercel-cache-reason header is internal-only).
- Additive promptSignals + a retrieval block so cache-reason questions
route here.
Net diff vs the original: +47 / -2 lines. All existing metrics/ISR/BYPASS
runbook content preserved. 899 tests pass; routing verified via the real
UserPromptSubmit hook.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Make cacheReason prompt signals consistent across reasons
Previously only stale_tag was a phrase. Add the other distinctive reason
slugs so pasting any of them from a log triggers the skill:
stale_time, stale_error, draft_mode, prerender_bypass (+ existing
stale_tag). Add 'cold cache' and 'request collapsed' to anyOf for MISS
coverage.
Bare cold/collapsed/error are intentionally NOT phrases — as ordinary
English words they would false-match unrelated prose. Verified:
"cacheReason: stale_error" and "prerender_bypass" fire cdn-caching, while
"fix this null pointer error" / "handle the error case" inject nothing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [skills] Route the cacheReason field name to cdn-caching
* [skills] Drop generic single-word cache-reason entities (cold, error, crawler) per review
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(marketplace): discover-first commerce routing + provisioning guidance
Make the model reliably reach for the Marketplace when an app needs an
external service, instead of hardcoding a provider from memory.
- knowledge-update (always-injected at session start): add a discover-first
directive — load the `marketplace` skill, then discover + provision a real
integration BEFORE planning/writing code/asking.
- marketplace SKILL.md: broaden the description (commerce/payments/etc. as the
catch-all for capabilities without a dedicated skill); restructure into
discover -> install -> build with an anti-mock/anti-punt rule; add a
Recommendations section keyed on the product-catalog test (commerce vs
payments), with no hardcoded providers (discover names them).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* fix(marketplace): remove command that shadowed the skill; tighten routing
The `marketplace` skill and `/marketplace` command shared a name, so the
command shadowed the skill — Skill(vercel:marketplace) loaded the command's
runbook instead, and the skill's routing guidance never reached the model.
Remove the command (marketplace is skill-only, like the other capabilities)
so the skill loads, and tighten routing: discover-first flow, a preferred-
provider table (commerce -> Shopify, payments -> Stripe), and a slimmer
knowledge-update that points at the skill.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* chore(release): patch-bump plugin manifests to 0.45.1
Backwards-compatible fix (marketplace skill routing); bump the version in
all three shipped manifests (.claude-plugin, .cursor-plugin, .plugin).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* knowledge-update: add 5GB package size + 100MB request body Functions limits
Add two new platform corrections to the knowledge-update skill:
- Functions now support up to 5 GB package size on Fluid Compute (was 250 MB)
- Functions now accept request bodies up to 100 MB (was 4.5 MB)
Also fix the now-stale bundle-size troubleshooting line in vercel-functions
and bump the knowledge-update header date.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* adding knowledge update for functions
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Vercel Functions now serve WebSocket connections natively. Document this
across the skill set, steer users away from the polling workarounds people
reach for, and correct the common belief that streaming/SSE requires the
Edge runtime.
- vercel-functions: new "## WebSockets" section (request lifecycle, Fluid
Compute requirement, Active CPU pricing) with ws, Socket.IO (server +
client transport gotcha), Next.js experimental_upgradeWebSocket, and
reconnect/persistent-state examples. Wire discovery via importPatterns
(ws, socket.io, socket.io-client), retrieval, docs, and promptSignals.
- promptSignals trigger on the long-polling workaround technique, but
deliberately NOT on named third-party services (Pusher, PubNub, Ably) —
those are intentional choices, not a signal someone is working around a
missing feature, so we don't nag.
- vercel-functions Streaming: call out that SSE/streaming works on the
default Node.js runtime — no runtime='edge' needed.
- knowledge-update: correct the stale "Functions can't hold WebSocket
connections" belief, add that streaming/SSE is not Edge-exclusive, and
reinforce that Edge is inferior in nearly every case.
- lexical-index: add polling/long-polling to the realtime synonym group so
the lexical fallback maps the workaround technique to websocket/realtime.
- vercel.md: add WebSockets to the compute list and Functions matrix.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* ci: add manifest-drift gate and correct stale generated artifacts
The committed skill-manifest.json had drifted from its source: the
`workflow` skill carried 11 path patterns (**/chain-engine*, **/orchestrat*,
**/escalation*, etc.) that were deliberately removed from skills/workflow/
SKILL.md in 498c263 ("fixing strict workflow skill detection"). They were
silently reintroduced into the manifest in 5641bff (#94), which regenerated
the manifest on a branch predating that removal. The skill-catalog.md had
the same workflow drift plus a stale vercel-connect entry.
Root cause: CI runs `bun run build` (which regenerates the manifest into the
working tree) and then tests against that fresh copy — it never verifies the
*committed* manifest matches source, so a stale committed manifest passes.
Fix:
- Add `--check` to scripts/build-manifest.ts: rebuilds in-memory and compares
to the committed file (normalizing the volatile generatedAt timestamp),
exiting non-zero on drift. Exposed as `bun run build:manifest:check`.
- Wire build:manifest:check (and the existing build:from-skills:check) into
CI *before* the build step, so they validate the committed artifacts on the
pristine tree rather than after build clobbers them.
- Regenerate skill-manifest.json and skill-catalog.md to heal the drift.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix: sort skill directory scan for deterministic manifest across platforms
scanSkillsDir() iterated readdirSync() output directly, whose order is
filesystem-dependent — roughly alphabetical on macOS/APFS but arbitrary on
Linux/ext4. The committed manifest was therefore generated in macOS order,
and build:manifest:check failed on the Linux CI runner because a fresh build
produced the same skills in a different key order (CI run on #103).
Sort the entries so manifest/catalog generation is byte-identical on every
platform. Regenerates skill-manifest.json and skill-catalog.md into sorted
order (one-time reordering churn; no semantic change).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The rule
pattern: export\s+default\s+function
message: 'Use named exports (GET, POST, ...) instead of default
export for route handlers'
fires on every page.tsx, layout.tsx, loading.tsx, error.tsx, not-found.tsx,
sitemap.ts, and template.tsx in a Next.js App Router project, where a default
export is *required*. Reported in anthropics/claude-code#54989 with concrete
reproduction (a 44-page App Router project firing the error on every page
write/edit).
Add a skipIfFileContains regex that matches the strongest signals of an
App Router file (and not a route handler):
- 'use client' directive
- App Router config exports (metadata / dynamic / revalidate / fetchCache /
runtime)
- export default function whose name ends in Page / Layout / Loading /
Error / NotFound / Sitemap / Template / Default (also lowercase
sitemap / robots / opengraph / manifest for the convention files)
- JSX with a capitalised component tag
- a destructured `{ children }` parameter (layouts / templates)
- a `MetadataRoute` reference (sitemap, robots, manifest helpers)
- imports from next/font, next/image, next/link, next/navigation,
next/headers, next/cookies
Each of these is overwhelmingly common in App Router pages and overwhelmingly
absent from route.ts handlers. A bug `export default function handler` in
a route.ts still fires the rule because none of the patterns match.
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
* feat(vercel-connect): add Eve adapter guidance
Adds Eve (@vercel/connect/eve) guidance to the vercel-connect skill,
renamed from the earlier Ash adapter per vercel/vercel#16541, covering
Slack/GitHub/Linear channels and BetterAuth/AuthJS providers.
Frontmatter: description mentions Eve agent connections + webhook
forwarding; adds the @vercel/connect/eve import pattern, agent/connections/**
and agent/channels/** path patterns, Eve retrieval metadata, and chainTo
rules for the eve import and hand-managed Slack/GitHub/Linear secrets.
Body: new "Eve agents" section (connect() helper), connectSlackCredentials
/ connectGitHubCredentials / connectLinearCredentials subsections, and a
BetterAuth/AuthJS support section.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(vercel-connect): correct BetterAuth/Auth.js connect() examples
BetterAuth's genericOAuth requires providerId and Auth.js requires id
alongside the connector UID. Connector UIDs can contain a / (e.g.
linear/myagent); reflect that in both examples.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(marketplace): simplify skill, emphasize discovery-first workflow
Trim marketplace SKILL.md from 491 lines to 212. Remove partner-facing
content (building integrations, Observability deep-dive, per-integration
code samples) and the hardcoded category list — those duplicate the live
\`vercel integration categories\` output and go stale.
Lead with a prominent "Discover BEFORE you scaffold" section so agents
treat \`vercel integration discover\` as the first action on casual
"build me X" prompts rather than scaffolding from memory.
Document the multi-\`--category\` flag pattern alongside the new
\`vercel integration categories\` subcommand.
Regenerate skill-manifest.json (intents updated: drop "build integration",
add "discover integrations").
* fix(commands): inline drain verification in marketplace template
The marketplace command template pulled the entire "Observability Integration Path" section from the marketplace skill, which was 50+ lines of vendor data-type tables and a 4-step setup flow — most of which the template's Step 7 didn't need.
The simplified marketplace skill (this PR) removed that section, breaking the include resolver. Inline only what Step 7 actually uses: the drain verification curl command and the logs/traces vs Speed-Insights/Web-Analytics distinction.
Regenerate commands/marketplace.md and build-from-skills manifest.
* test(build-from-skills): regenerate snapshots after marketplace skill changes
* docs(marketplace): apply PR #99 review feedback
Address inline review comments from @bhrigu123 on the marketplace simplification PR:
- Clarify "repo" → "local directory linked to a Vercel project" (preflight)
- Drop "(rare — usually narrow with --category)" qualifier
- Use "query" instead of "name" for discover substring search
- Restore concrete `vercel integration guide` examples and clarify `<name>`
- Drop ".env.local" filename from `vercel env pull` (CLI default)
- Remove inaccurate 1–3 minute provisioning-delay note
- Clarify Connectable accounts require browser/Dashboard setup, not CLI
- Restore data-type split table + Speed Insights drain example in /marketplace
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(marketplace): correct category slugs + categories --json → --format=json
Three correctness bugs caught in review:
- `--category auth` → `--category authentication` (live /v2/integrations/categories returns "authentication"; "auth" returns 0 results). Two occurrences: skills/marketplace/SKILL.md and commands/marketplace.md.tmpl.
- `--category databases` → `--category storage` (same root cause; "databases" is not a valid slug).
- `vercel integration categories --json` → `--format=json` (the categories subcommand uses validateJsonOutput per vercel/vercel#16576; --json was explicitly deprecated in that PR).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(skills): add vercel-connect skill
Adds a Claude skill for Vercel Connect — guides agents through the
CLI workflow (`vercel connect create/list/token`), the @vercel/connect
SDK (getToken, /ash subpath, connectSlackCredentials), and the HTTP
API for non-JS callers.
Source: ported from vercel/connect's skills/vercel-connect/SKILL.md,
with frontmatter enriched to match vercel-plugin's pattern
(metadata.priority, docs, importPatterns, bashPatterns, promptSignals,
retrieval, chainTo).
The @vercel/connect package itself is being moved to vercel/vercel
in a companion PR: https://github.com/vercel/vercel/pull/16462
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(ecosystem): add vercel-connect to ecosystem graph
The validate script requires every skills/ directory to have a
matching ⤳ skill: reference in vercel.md's ecosystem graph.
Adds a VERCEL CONNECT block under Security alongside
AUTHENTICATION INTEGRATIONS, listing the CLI / SDK / HTTP API
integration paths and OIDC + Ash dependencies.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: regenerate skill-catalog with vercel-connect
Run scripts/generate-catalog.ts to include the new vercel-connect
skill in generated/skill-catalog.md. The validate script requires
the catalog to list every skill in skills/.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: regenerate skill-manifest with vercel-connect
Companion to the catalog regen — generate-catalog also refreshed
the manifest with 142 lines of vercel-connect entries (trigger
patterns, retrieval metadata, chainTo).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(skills): address vercel-connect review feedback from dvoytenko
- Rename `<provider>` placeholder to `<service>` in CLI examples
- Expand Available Services table: add MCP servers, Snowflake,
Salesforce, and generic OAuth alongside Slack and GitHub
- Update Ash example: use `/mcp` endpoint (not `/sse`) and the
correct URL-style connector ID (`mcp.linear.app/myagent` rather
than `linear`)
- Update Workflow URL example to `/mcp`
- Expand frontmatter retrieval + promptSignals with MCP, Snowflake,
and Salesforce terms so prompts like "connect to mcp server"
trigger the skill
- Regenerate skill-manifest.json + skill-catalog.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(skills): strip Ash, fix HTTP auth + Python field + subject types
Strip Ash from the vercel-connect skill (the @vercel/connect package
renamed Ash -> Eve in vercel/vercel#16541 and is moving away from
adapter-specific guidance in this skill).
Frontmatter:
- Remove importPatterns `@vercel/connect/ash`
- Remove pathPatterns `agent/connections/**` and `agent/channels/**`
- Remove retrieval.entities `Ash`, retrieval.examples / intents
referencing Ash agents
- Remove the two chainTo rules tied to Ash imports and
SLACK_BOT_TOKEN / SLACK_SIGNING_SECRET (the latter pointed at the
Ash-only `connectSlackCredentials` helper)
- Drop "building Ash agent connections" from description
Body:
- Delete `#### Ash agents — @vercel/connect/ash` section
- Delete `##### Slack channel — connectSlackCredentials` subsection
Factual fixes against vercel/vercel:packages/connect/ (current `main`):
1. HTTP API Python example: response field is `token`, not
`accessToken` (src/token.ts:51-69).
2. HTTP API examples now include the required
`Authorization: Bearer <VERCEL_OIDC_TOKEN>` header — without it the
request 401s (src/token.ts:148-158).
3. "Modes of tokens" now lists all three subject types: `user`, `app`,
and `jwt-bearer`. The third was added in vercel/vercel#16520
(src/token.ts:4-29) and was missing from the skill.
4. Workflow step 2: "register-token" terminology replaced with the
actual CLI command name `vercel connect create`.
No restructure, no new API surface added (revokeToken, /ai-sdk, /mcp,
/betterauth, /authjs, startAuthorization, typed errors are
intentionally out of scope for this update). Net: -69 / +19 lines.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(skills): remove Salesforce from vercel-connect skill
Per @dvoytenko review on #94 — Salesforce isn't a supported Connect
service yet, drop it for now.
Removed:
- Services table row
- description copy
- retrieval.entities, retrieval.intents, promptSignals.phrases
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: add microfrontends skill
Adds the `microfrontends` skill (SKILL.md + 6 reference docs covering
configuration, path-routing, local development, management, security,
and troubleshooting) for building, configuring, and deploying
microfrontends on Vercel.
Triggering covers the common entry points:
- pathPatterns: microfrontends.json / apps/*/microfrontends.json
- bashPatterns: `vercel microfrontends` / `vercel mf`, and
npm/pnpm/bun/yarn install of @vercel/microfrontends
- importPatterns: @vercel/microfrontends
Regenerates generated/skill-manifest.json and generated/skill-catalog.md
(now 27 skills) and updates the vercel.md ecosystem graph.
Rebased onto current main as a single signed commit (supersedes #35).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs(microfrontends): trim reference boilerplate
Lowest-risk size reduction with no loss of factual content:
- Remove Table-of-Contents blocks from local-development, managing-
microfrontends, and troubleshooting references. No other skill's
reference files use a ToC (0 of 51 repo-wide) — these were the only
outliers; removal aligns with house convention. Section anchors are
unaffected, so in-doc links still resolve.
- Tighten security.md: dedupe repeated "verified only by…" prose and
collapse repeated full URLs. All 13 original links preserved.
Net: -64 lines across 4 reference files. References are loaded on demand
(grep), not part of the injected SKILL.md budget, so this is a read-cost
and maintainability win, not an injection-size change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: bump version for all providers; bump to 0.44.0
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: update telemetry version assertions to 0.44.0
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jerilyn Zheng