- #954: strip non-spec source/attribution keys from all 39 plugin.json
manifests so Claude Code's validator accepts them; metadata preserved in
new .claude-plugin/authoring-notes.json sidecars; check_plugin_json.py now
hard-fails manifests carrying those keys and sanity-checks the sidecar;
CLAUDE.md ClawHub schema section updated to the new rule.
- #949: move the c-level-agents plugin out of c-level-advisor/ to a
top-level directory so the two marketplace sources no longer overlap;
updated marketplace.json source, homepage, descriptions, all
cross-references, docs, harness manifest, mirror-tree symlinks/indexes,
and rebased the moved files' relative links; domain counters trued up
(18 -> 19 domains).
- #933: replace dead links to the gitignored maintainer-local megaprompts/
tree with annotated plain-text references (44 files: SKILL.md, READMEs,
agents, commands).
- #931: DynamoDB on-demand pricing updated to post-Nov-2024 rates
($0.625/M writes, $0.125/M strongly consistent reads).
- #969: skill_security_auditor.py and the three dossier scripts reconfigure
stdout/stderr to UTF-8 (errors=replace) so legacy Windows codepages no
longer crash at print time; PYTHONUTF8=1 documented.
- #968: Windows Notes section in INSTALLATION.md + README pointer for the
core.symlinks mirror-tree checkout caveat.
- #924/#885 residuals: hook commands quote "${CLAUDE_PLUGIN_ROOT}" paths in
all plugin hooks.json/settings.json (space-safe roots); removed the stale
pre-rename status/review mirror symlinks and index entries left over from
the memory-status/memory-review rename.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4
- convert.sh's SKILL.md finder now excludes .claude, .codex, .codex-plugin,
.gemini, .hermes, .vibe, and docs — these are generated/symlinked mirrors
for other tools, not source-of-truth skills. On platforms where git
materializes symlinks as plain text (e.g. Git Bash on Windows), the
mirrored files were being parsed as SKILL.md candidates and failing
frontmatter extraction, flooding the run with "Skipping invalid
frontmatter" warnings (#897).
- Renamed the self-improving-agent (si) plugin's `status` and `review`
skills to `memory-status` and `memory-review` so their bare `name:`
values no longer collide with Claude Code's built-in `/status` and
`/review` commands (#885). Updated all in-plugin references
(CLAUDE.md, README, agents, hooks, references, settings.json,
plugin.json) to the new `/si:memory-status` / `/si:memory-review`
invocations.
Fixes#897 (duplicate of #896), #885.
Resolves#712 and #714.
Claude Code's plugin spec (code.claude.com/docs/en/plugins-reference) requires
"All paths must be relative to the plugin root and start with ./". CC 2.1.144+
rejects the bare "skills" form with `Validation errors: skills: Invalid input`,
breaking plugin installs from this repo.
Changes:
- 47 plugin.json manifests migrated from "skills": "skills" → ["./skills"]
(canonical post-CC 2.1.144 form, also accepts string "./skills")
- scripts/check_plugin_json.py rewritten to enforce the live spec:
* Hard-fails on non-"./"-prefixed strings (except the legacy "skills" literal)
* Hard-fails on empty strings/arrays and non-string array entries
* Emits WARN (non-fatal) on the legacy "skills" literal as a safety net
for copied templates — the WARN tolerance can be removed later
* Tested against all four canonical forms + 3 garbage forms
- CLAUDE.md §5 rewritten to document the live spec, including the historical
context of the v2.1.107 → v2.1.144 regression window that's now closed
- 15 stale broken symlinks under .gemini/skills/ removed (orphans from older
reorgs that the sync script didn't prune because its cleanup is disabled)
Verification:
- scripts/check_plugin_json.py --all → 0 FAIL, 0 WARN, exit 0 (69 files OK)
- pytest tests/ → 2103 passed
- find . -type l ! -exec test -e {} \; → 0 broken symlinks
- Live spec forms tested: ["./"], ["./skills"], "./skills", ["./a","./b"] all pass
- Garbage forms rejected: bare "./", empty array, non-string entries, plain strings
Claude Code 2.1.133+ rejects "skills": "./skills" with a "Path escapes
plugin directory" warning, even though ./skills resolves to a valid
subdirectory inside the plugin root. Per the upstream docs example, the
correct value is "skills" (no ./ prefix), which works across all CC
versions and other tools (Codex, Gemini CLI, etc.).
Applied to all 47 plugin.json files that used "./skills"; updated
CLAUDE.md ClawHub publishing constraints to document the new convention
and reference the issue.
The /si:extract command and its skill-extractor agent had no guard
against the Claude Code skill-spec reserved name fragments. Users
reported the agent autogenerating skills like 'claude-code-settings',
'claude-mcp-tools', etc. — all of which violate the spec.
- Add explicit reserved-fragment rule to both the slash-command
SKILL.md and the agent definition.
- Recommend the 'cc-' prefix for Claude Code-specific skills
(cc-settings, cc-maintenance, cc-mcp-tools).
- Add the check to both quality-gate checklists so the agent
surfaces a rename before writing files.
Closes#537
Karpathy-style review of commit 3806b9b (the prior PR commit) caught real
issues that I missed: agents weren't fully equipped per the optional but
recommended fields in the official sub-agents spec.
Changes:
- engineering/agenthub/agents/hub-coordinator.md: narrow Bash(node *) (too
broad per defense-in-depth) -> moved node into disallowedTools; add
maxTurns: 100 (orchestrators run long); add skills: agenthub:agenthub
(preload the plugin's own guidance into agent context)
- engineering-team/self-improving-agent/agents/memory-analyst.md:
add maxTurns: 30 to bound runaway analysis loops
- engineering-team/self-improving-agent/agents/skill-extractor.md:
add disallowedTools (rm/curl/wget) — agent has Write+Edit so defense-in-
depth applies; add maxTurns: 30
- engineering/karpathy-coder/agents/karpathy-reviewer.md: fix skills field
format from path-style "engineering/karpathy-coder" to spec-correct
namespaced name "karpathy-coder:karpathy-coder" (the path syntax is the
cs-* orchestrator template convention; the official sub-agents spec uses
skill names per code.claude.com/docs/en/sub-agents); add maxTurns: 30
All 6 plugin agents (4 here + 2 in playwright-pro from prior commit) +
the 1 user agent (tech-ingester) now have name + description + tools +
disallowedTools (where write-capable) + model + maxTurns. The skills:
field is set on agents that benefit from preloaded domain skill content.
Functional smoke tests post-fix:
- memory-analyst: PASS (2 turns, 25s, 24K tokens, found 1 real orphan)
- skill-extractor: PASS (0 tool uses, 34s, 17K tokens, generated correct
plan staying read-only with new disallowedTools in effect)
- karpathy-reviewer: PASS (verified in prior session, 28 tool uses)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Per https://code.claude.com/docs/en/sub-agents, agents require YAML
frontmatter with name + description, and the field is `tools:` not
`allowed-tools:` (deprecated). Bare `Bash` allows any command including
curl/wget/rm, which violates defense-in-depth.
Changes:
- engineering/agenthub/agents/hub-coordinator.md: add full frontmatter
(name, description, tools allowlist for git/python/node/Agent,
disallowedTools for rm -rf / curl / wget / git push --force, model)
- engineering-team/self-improving-agent/agents/memory-analyst.md:
add frontmatter, read-only tools (Read, Glob, Grep)
- engineering-team/self-improving-agent/agents/skill-extractor.md:
add frontmatter, write tools (Read, Write, Edit, Glob, Grep)
- engineering-team/playwright-pro/agents/test-architect.md:
rename allowed-tools to tools, add model: inherit
- engineering-team/playwright-pro/agents/migration-planner.md:
same rename
- engineering-team/playwright-pro/agents/test-debugger.md:
rename + narrow bare Bash to npx playwright / node / npm patterns,
add disallowedTools for rm / curl / wget / destructive git
- engineering/karpathy-coder/agents/karpathy-reviewer.md:
narrow bare Bash to git read-ops + python, add disallowedTools
All registered agents now load cleanly under the sub-agents spec rather
than falling through to permissive registration.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PR #587 fixed `"skills": "./"` in 35 plugin.json files but did not bump
versions. Claude Code uses version as the cache key — same version string
means /plugin update is a no-op and users keep loading the cached
plugin.json with the broken path. The /plugin UI shows "1 error" on
every plugin from this marketplace because the installed cache is stale.
Per the official version-management docs:
> If you set `version` in `plugin.json`, you must bump it every time
> you want users to receive changes. Pushing new commits alone is not
> enough.
Bump every plugin.json by one patch using max(plugin_version,
marketplace_version) as the base so no version moves backward. Sync the
new versions back into .claude-plugin/marketplace.json.
After this lands, users run `/plugin marketplace update claude-code-skills`
followed by `/plugin update --all` to pull the fixed manifests.
Claude Code v2.1.107+ rejects bare "skills": "./" with "Path escapes
plugin directory: ./". This blocks every plugin in the marketplace from
loading. Replace with the layout-appropriate form per the official
plugins reference:
- Single-skill plugin (SKILL.md at root):
"skills": ["./"] array form (per docs example)
- Plugin with skills/ subdir:
"skills": "./skills" standard subdir layout
- Multi-skill domain plugin (skills are subfolders at root):
"skills": ["./sub1", "./sub2"] explicit list of skill dirs
The multi-skill case omits "./" from the array so the index SKILL.md
at the plugin root does not register as a skill — that would create
a redundant `marketing-skills:marketing-skills` namespace.
Verified by running `claude plugin validate` against all 35 manifests.
Closes#539
The plugin.json configured 'skills': './' which scans the plugin root for SKILL.md files. This found the root SKILL.md (name: 'self-improving-agent') and stopped, preventing Claude Code from discovering the subskills (review, promote, extract, status, remember) in the skills/ subdirectories.
Fix: Move root SKILL.md to skills/self-improving-agent/SKILL.md and update plugin.json to 'skills': './skills/' so Claude Code recursively scans the skills/ directory and discovers all 5 subskills.
This enables the intended /si:review, /si:promote, /si:extract, /si:status, /si:remember slash command routing.
Issue #506 reported that `hooks/hooks.json` used `./hooks/error-capture.sh`
which fails for any session started outside the plugin dir. That specific
file was already fixed in commit 217b199 (which closed#392) — both
`hooks/hooks.json` and `settings.json` already use `${CLAUDE_PLUGIN_ROOT}`.
However, two stale example paths were still surfacing the bug in
documentation:
1. `engineering-team/self-improving-agent/CLAUDE.md` line 74 — "To enable"
example with `./skills/self-improving-agent/hooks/error-capture.sh`
2. `engineering-team/self-improving-agent/hooks/error-capture.sh` header
comment — install example with the same broken path
Both examples would teach users to copy the broken pattern into their own
settings.json, reproducing the exact bug #506 describes.
Fix: rewrite both examples to use `${CLAUDE_PLUGIN_ROOT}/hooks/error-capture.sh`
and add explicit "do not use relative paths" warnings. Also clarify in
CLAUDE.md that manual hook wiring is NOT needed when installing via
`/plugin install` — the hook is registered automatically from the plugin's
hooks.json.
Fixes#506
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bug: after `/plugin install self-improving-agent@claude-code-skills`, only
1 skill appeared and `/si:review`, `/si:promote`, `/si:extract`, `/si:status`,
`/si:remember` were all unknown commands. The 5 sub-skills were silently
registered under the wrong namespace.
Root cause: two issues in the plugin manifest layer.
1. **Slash-command namespace is derived from `.claude-plugin/plugin.json`
`name`**, not from the marketplace entry name, the settings.json name, or
frontmatter. Previous `name: "self-improving-agent"` caused sub-skills to
register as `/self-improving-agent:review` etc — never matching the
documented `/si:*` commands.
2. **`command: /si:<op>` frontmatter in sub-skill SKILL.md files is a
non-standard field** not in the Claude Code Skills spec. Claude Code
silently ignores it. It created the illusion that the commands were being
registered when they were not.
Fix:
- Change `engineering-team/self-improving-agent/.claude-plugin/plugin.json`
`name` from "self-improving-agent" → "si". This is the namespace root; it
does NOT affect the marketplace install identifier (which stays
`self-improving-agent` via the marketplace.json `name` field). After the
fix, skills register as `/si:review`, `/si:promote`, `/si:extract`,
`/si:status`, `/si:remember` — matching the README and CLAUDE.md docs.
- Remove the non-standard `command: /si:<op>` frontmatter line from all 5
sub-skill SKILL.md files (review, promote, extract, status, remember).
Frontmatter now contains only `name` and `description` per the Claude Code
Skills spec.
- Bump plugin.json version 2.1.2 → 2.3.0 to match repo release.
- Update marketplace.json entry: version 2.2.0 → 2.3.0, expand description
to list all 5 slash commands and 2 sub-agents.
OpenClaw compat: the legacy `settings.json` inside the skill directory still
uses `"name": "self-improving-agent"` for OpenClaw's install path. Claude Code
ignores settings.json entirely, so this is safe to leave as-is.
Install flow (unchanged, verified correct after fix):
/plugin marketplace add alirezarezvani/claude-skills
/plugin install self-improving-agent@claude-code-skills
# → 5 skills register as /si:review, /si:promote, /si:extract,
# /si:status, /si:remember
Known related issue (not fixed in this PR to keep scope tight): `agenthub`
has the identical bug. Its plugin.json `name` is "agenthub", so sub-skills
register as `/agenthub:init` rather than the documented `/hub:init`. Same
fix applies: rename plugin.json `name` to "hub". Will file as a follow-up.
Fixes#505
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- executive-mentor: add url to author, add homepage + repository
- self-improving-agent: add url to author, version 1.0.0 → 2.1.2
- playwright-pro: fix author name (Reza → Alireza), replace email with url, version 1.0.0 → 2.1.2
- google-workspace-cli: add url to author
All plugin.json files now use consistent author object format.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Relative paths (./hooks/error-capture.sh) resolve against the project
working directory, not the plugin root. Replaced with
${CLAUDE_PLUGIN_ROOT}/hooks/error-capture.sh in both hooks.json and
settings.json.
Fixes#392
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
