Conduct reports now go only through the contact listed on uupm.cc.
General questions now go to the repository issues page, and the README
remains the other place to look. The quickstart clones this repository
and enters ui-ux-pro-max-skill/stack before the existing setup step. A
community-docs test checks those sections for the replacement
destinations, the absence of the dead Discussion and old clone URLs,
enforcement staying off public issues and mailto links, and the setup
script being present.
Refs #542
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
* feat(cli): add Kimi Code platform (--ai kimi)
Kimi Code discovers skills as SKILL.md folders (name + description frontmatter) in .kimi-code/skills/ (project) and ~/.kimi-code/skills/ (user). Add a kimi platform template, register the type, detect an existing .kimi-code folder, and document it in the README.
Tests: add kimi to the dry-run and script-path e2e specs. check:assets, typecheck and those specs pass; init --ai kimi was run in an empty repo. Kimi Code itself was not run.
Refs #455.
* test(cli): add kimi install and detection specs
Cover the rendered SKILL.md frontmatter, a real install into .kimi-code/skills (skill, data, scripts and sub-skills), and detection of a .kimi-code folder. Refs #455.
* fix(scripts): expect 24 platform configs in validate-agent-guide
Adding the kimi platform template raises the config count from 23 to 24. Keep the check strict and update the expected count. Refs #455.
* test(cli): expect 24 platform configs in agent-query-contract
The kimi platform raises the platform config count from 23 to 24. Refs #455.
* feat: add OpenClaw platform support
Add OpenClaw as an install target so the skill can be installed with
`uipro init --ai openclaw` and removed via `uipro uninstall`.
OpenClaw discovers AgentSkills-format skills from `.agents/skills` in the
agent workspace and from `~/.agents/skills` (personal library on the default
state dir), so the platform config reuses the `.agents` layout already used
by the universal/codex targets with its own display name, detection entry,
and docs.
- new platform config src/ui-ux-pro-max/templates/platforms/openclaw.json
(synced to cli/assets via sync:assets)
- register 'openclaw' in AIType, AI_TYPES, AI_FOLDERS, AI_TO_PLATFORM
- detect the shared .agents workspace directory and describe the platform
- keep the .agents-family suggestion on codex when all four .agents
consumers are detected (length 2-3 -> 2-4)
- cover openclaw in the dry-run, template-script-paths, and
agent-query-contract e2e specs
- document OpenClaw in README and cli/README
* chore: bump version to 2.15.0 in skill metadata files
Aligns skill.json, marketplace.json, and plugin.json with the latest
v2.15.0 release; main was still at 2.13.0. CLI package version stays on
its own npm release track.
* fix: cover OpenClaw in offline validator and detection regression
- bump scripts/validate-agent-guide.py PLATFORM_COUNT 21 -> 23 (main
already had 22 configs with a stale count of 21; OpenClaw widens the
gap to 23, so update the gate and keep it meaningful)
- add e2e regression: a sole .agents directory detects all four
consumers (antigravity, codex, universal, openclaw) and still
suggests codex rather than all
* fix: stop Cursor skill pointing at empty Quick Reference
Platforms that set quickReference to false omitted the inlined
reference but still told the agent to use "the Quick Reference
sections above." Resolve QR/NOQR variants so Cursor (and other
non-inlined platforms) follow the existing search flow instead.
Claude and Codex keep the inlined reference wording.
Co-authored-by: Neal Meyer <ngmeyer@users.noreply.github.com>
* fix: accept 21 platform configs after ZCode
ZCode landed on main without updating the agent-guide validator
or the platform-count e2e assertion. This branch did not add a
platform; the stale expected count of 20 was failing CI.
Co-authored-by: Neal Meyer <ngmeyer@users.noreply.github.com>
* fix: refresh stale relevance runtime fingerprint
verify:data would fail next on evaluate:relevance because main's
threshold manifest still hashed the pre-#500 runtime. Metrics are
unchanged; only the fingerprint now matches current scripts/data.
Co-authored-by: Neal Meyer <ngmeyer@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Neal Meyer <ngmeyer@users.noreply.github.com>
* fix(data): regenerate stale catalog-summary snapshot hashes
catalog-summary.json was not regenerated after google-fonts.csv,
google-font-licenses.json, icons.csv and phosphor-icons-upstream.json
changed, so `npm --prefix cli run verify:data` fails on a clean
checkout of main:
validate:semantic 4 stale snapshot errors
validate:catalog-summary "catalog-summary.json is stale"
test:python 1 failure / 153
check:assets 2 files out of sync
Regenerated with the existing --verified-at 2026-08-26: only the four
sha256 fields change. The date is a human attestation that the font
catalog was checked against the upstream google/fonts repository, so it
is deliberately left untouched -- no such verification was performed
here.
verify:data now exits 0.
Note: prepublishOnly runs sync:assets before verify:data, which
regenerates the snapshot at publish time. That is why released packages
are unaffected and the drift stayed invisible on main.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UidECV1wVBD8SW6Abuj71
* fix(data): make catalog snapshot hashes line-ending independent
Root cause of the stale snapshot restored in the previous commit.
bd19ab9 (#462) regenerated catalog-summary.json from a CRLF checkout.
Every recorded sha256 was the CRLF hash of its source file, so the
check failed on every LF platform. The four committed values are
exactly sha256(crlf_bytes):
google-fonts.csv committed d03194d2… = CRLF hash
google-font-licenses.json committed 7c35e410… = CRLF hash
icons.csv committed 272ccf0e… = CRLF hash
phosphor-icons-upstream.json committed 81c37fb3… = CRLF hash
Two conditions had to combine: the digest hashed raw bytes, and no
.gitattributes pinned these files to LF, so Windows checkouts get CRLF
by default. Restoring the hashes alone would let the next contributor
on Windows reproduce the same commit.
Three changes:
- normalize line endings in generate-catalog-summary.py's digest(), so
the snapshot no longer depends on the checkout
- apply the same normalization in validate_data.py, which independently
recomputes the hashes and has to agree with the generator
- add .gitattributes pinning src/ui-ux-pro-max/data/*.{csv,json} to LF,
so a Windows checkout matches the committed bytes in the first place
sync-assets.mjs already normalizes to LF, so this only extends an
existing project convention to the two places that were missing it.
Adds test_catalog_summary_line_endings.py: LF and CRLF inputs must
digest identically, the committed snapshot must match the normalized
sources, and a simulated CRLF checkout must still produce the recorded
hashes. The third case fails against the pre-fix digest.
verify:data exits 0; the Python suite goes from 153 to 156 tests.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UidECV1wVBD8SW6Abuj71
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
- add CSV structural validation and all-domain smoke tests
- repair malformed CSV rows in source and bundled CLI assets
- run data validation in CI and prepublish checks
- add npm build wrapper with TypeScript fallback when Bun is unavailable
- fix CLI asset resolution for TypeScript fallback builds
Adds WPF, WinUI 3, UWP, Avalonia, and Uno Platform stacks (17 -> 22 total),
each with its own guidelines CSV, registered in core.py and synced to cli/assets.
- New stack CSVs in src/ and cli/assets/data/stacks/
- search.py / core.py registry updated
- smoke-stacks.sh: EXPECTED_STACK_COUNT 21 -> 22 with a smoke-test workflow
- platform template descriptions and README bumped to 22 technology stacks
