You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Release 0.2.0: native skills for every agent, Studio, Kickstart, Live Preview protocol - #21
This PR brings together work from several open PRs, plus a refresh of how the bundle is packaged, into one release: 0.2.0. Rather than land each PR on main separately, we integrated and fixed them on next so they could be reviewed together. Full release notes are in CHANGELOG.md.
The new studio skill and its 109 specialist guides
Commits that apply someone else's work carry a Co-authored-by trailer.
What changes
1. One source, installed natively everywhere
Every tool we target now reads skills/<slug>/SKILL.md directly: Claude Code, claude.ai, Cowork, Cursor, Codex, GitHub Copilot, Gemini CLI and the skills CLI. So we no longer generate copies for each tool.
Removedcursor/rules/, codex/, scripts/build-*.sh, the skills/CLAUDE.md router and the unused manifest.json. The build scripts had real bugs:
disable-model-invocation was converted into alwaysApply: true, so the manual-only Launch skills loaded into every Cursor chat.
Every --- line was stripped from skill bodies.
The Codex copies lost their frontmatter.
Manifests, all at version 0.2.0:
File
Change
Tools
.claude-plugin/
Updated
Claude Code, claude.ai, Cowork, Copilot CLI
root plugin.json
New (Agent Plugins 1.0)
Codex, Cursor, VS Code
.agents/plugins/marketplace.json
New
Codex
.cursor-plugin/
Now points at skills/, plus a new marketplace file
Cursor
gemini-extension.json
Slimmed
Gemini CLI
Descriptions do the routing. Each skill's description now includes the "Use when…" triggers that used to sit in the router, which no plugin ever loaded.
Skill names match their folders:migration-companion and dx-kickstart-next.
Skill names changed: contentstack-migration-companion → migration-companion and contentstack-kickstart-next → dx-kickstart-next.
Testing
node scripts/validate.mjs: 23 skills and 7 manifests valid. I also checked that it fails on a bad name, a broken link and a version mismatch.
claude plugin validate . passes. The one warning is about the contributor CLAUDE.md at the repo root, which plugins don't load; that's expected.
Claude Code: marketplace added and plugin installed from a local path; all 23 skills present.
Codex: marketplace added and plugin installed (0.2.0); all 23 skills present.
npx skills add . --list finds 23 skills.
Not tested yet: Cursor, Copilot, Gemini CLI, and claude.ai sync (which needs the pushed branch). Reviewers with those tools, please try the README steps.
Reviewers
The workflow change (.github/workflows/) needs @contentstack/security-admin, per CODEOWNERS.
A repo admin should delete the stale develop branch. It was created while setting this up, and the branch ruleset prevents deleting it.
All target tools (Claude Code, claude.ai, Cursor, Codex, Copilot, Gemini
CLI, skills CLI) now read skills/<slug>/SKILL.md directly, so remove the
generated cursor/rules and codex trees and their build scripts, which had
an inverted alwaysApply mapping, stripped --- lines from bodies and lost
frontmatter.
- Fold router "Use when" triggers into each skill description and drop
skills/CLAUDE.md, which no plugin loads
- Rename migration-companion's name to match its folder
- Add Agent Plugins plugin.json, Codex and Cursor marketplaces; use "./"
source for claude.ai sync; bump all manifests to 0.2.0
- Replace build workflow with scripts/validate.mjs (spec + version checks)
- Remove unused manifest.json; rewrite README install per tool
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rebuilds the support skill as a 7-step evidence-first protocol with 12
reference files, renamed to cms-live-preview-visual-editor-support-assistant.
On top of the PR: description keeps the previous triggers (SSR state,
cache contamination, edit-tag mapping, lost context, code review) and says
"Use when"; never log hash values (log presence only); Management Token
write access depends on scope; regressions read the Onboarding Check before
asking what changed; SSR evidence comes from server logs or a proxy trace.
Docs and README updated for the new slug.
Co-authored-by: Hitesh Shetty <hitesh.shetty@contentstack.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds skills/studio: a router SKILL.md, skills-index.md and 109 specialist
guides copied from contentstack/studio-docs.
On top of the PR: description restructured to include "Use when" for the
validator; generated cursor/codex/manifest/router and build-script changes
dropped (no longer exist on next); README row plus docs/skills/studio.md
and index, selection and skills CLI entries.
Co-authored-by: Sumit Jain <266980249+sumitjain-cstk@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SKILL.md goes from 959 to 338 lines; step detail moves verbatim into
references/step-*.md and loads only when that step runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- validate.mjs checks relative links in all markdown under skills/
- CHANGELOG.md with the 0.2.0 release notes; release steps mention it
- README: multi-skill skills CLI example (from PR #12 by @netrajpatel)
Co-authored-by: Netraj Patel (Contentstack) <netraj.patel@contentstack.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Release 0.2.0 consolidates native skills across supported agents, adds Studio and Kickstart guidance, refreshes migration and Live Preview content, and updates packaging, documentation, and validation.
Changes:
Added Studio, Kickstart, migration, and Live Preview guidance.
Replaced generated agent artifacts with native skill manifests.
Added installation, architecture, security, and release documentation.
Added validation CI and updated contributor guidance.
- migration-companion: unique session dir via mktemp; update the csdx
plugin in place instead of uninstalling first
- studio: runnable payload builder, accurate corruption explanation, no
TLS verification bypass, string props use the `text` static_value bucket,
router authtoken rule matches the OAuth-first ladder
- dx-kickstart-next: add the mandatory Security section
- docs: Studio product defaults in the security model, counts no longer
hardcoded to 22, AGENTS.md described as a symlink
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A syntactically valid but malformed config such as [] is not handled: json.loads succeeds, then d.get(k) raises AttributeError instead of returning NOT_FOUND with exit 1 as this helper promises. Treat non-object JSON values as unusable before iterating the token keys so a corrupt config follows the documented recovery path.
- redact() splits at :<line>: (Windows paths), normalizes backslashes and
masks quoted literals from 8 chars, the same floor as the checks
- 12_secrets.sh checks configured log dirs even before log.sh creates them
- read_cf_token.py treats non-object JSON configs as unusable
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Re the "previously missed" finding about read_cf_token.py: fixed in 22c88a0. A config that is valid JSON but not an object (e.g. []) is now skipped, so the helper returns NOT_FOUND with exit 1, as documented. Tested.
…rets, string buckets
- launch-trigger: explicit confirmation before every deployment, not only
production; monitoring requests never trigger one
- _lib.sh redact(): mask every quoted value on credential lines, and
quoted literals from 6 chars elsewhere (lowest check threshold)
- studio static values: single-line string -> text, multiline -> textarea
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This page is now inconsistent with the action skill: the implementation requires confirmation before every deployment, including staging/non-production, but this procedure and its inputs only gate production. Because this page is the public runbook, following it can still trigger an unconfirmed non-production POST. Update the workflow, inputs, and safety note to require confirmation for every trigger, with an additional production check.
log.sh uses only the first non-empty location in the precedence chain (MIG_LOG_DIR, otherwise SESSION_DIR/migration-log, otherwise <target>/.migration), but this loop checks all configured locations. For example, a safe MIG_LOG_DIR plus an unignored SESSION_DIR inside the target causes this hard-gate eval to fail even though no log will be written there. Check only the effective log directory (or otherwise apply the same precedence) so valid configurations are not blocked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR brings together work from several open PRs, plus a refresh of how the bundle is packaged, into one release: 0.2.0. Rather than land each PR on
mainseparately, we integrated and fixed them onnextso they could be reviewed together. Full release notes are inCHANGELOG.md.Thanks to the original authors
dx-kickstart-nextskill and thedocs/site<this-repo>placeholders, which the new install section builds on, and the example for installing several skills at once"./"plugin source that lets claude.ai and Cowork sync the repostudioskill and its 109 specialist guidesCommits that apply someone else's work carry a
Co-authored-bytrailer.What changes
1. One source, installed natively everywhere
Every tool we target now reads
skills/<slug>/SKILL.mddirectly: Claude Code, claude.ai, Cowork, Cursor, Codex, GitHub Copilot, Gemini CLI and theskillsCLI. So we no longer generate copies for each tool.Removed
cursor/rules/,codex/,scripts/build-*.sh, theskills/CLAUDE.mdrouter and the unusedmanifest.json. The build scripts had real bugs:disable-model-invocationwas converted intoalwaysApply: true, so the manual-only Launch skills loaded into every Cursor chat.---line was stripped from skill bodies.Manifests, all at version
0.2.0:.claude-plugin/plugin.json.agents/plugins/marketplace.json.cursor-plugin/skills/, plus a new marketplace filegemini-extension.jsonDescriptions do the routing. Each skill's
descriptionnow includes the "Use when…" triggers that used to sit in the router, which no plugin ever loaded.Skill names match their folders:
migration-companionanddx-kickstart-next.2. Skills
dx-kickstart-next(added kickstart skill and docs #11).studio(feat: add the Contentstack Studio skill #20). On top of the PR:studio-docsrepo (37 relinked, 50 turned into plain text).cms-live-preview-visual-editor-support-assistant. On top of the PR:migration-companion.SKILL.mdgoes from 959 to 338 lines. Per-step detail moved word for word intoreferences/step-*.md.3. CI, docs and contributors
build.ymlis nowvalidate.yml, runningnode scripts/validate.mjs. It checks:docs/updated to match, with new claude.ai/Cowork and Copilot install pages.CLAUDE.mdis now the contributor guide, andAGENTS.mdlinks to it.CHANGELOG.mdis added.Breaking changes
cursor/rules/andcodex/are gone. Anyone who copied them by hand should reinstall with the README instructions.cms-live-preview-visual-builder-support-assistant→cms-live-preview-visual-editor-support-assistant.contentstack-migration-companion→migration-companionandcontentstack-kickstart-next→dx-kickstart-next.Testing
node scripts/validate.mjs: 23 skills and 7 manifests valid. I also checked that it fails on a bad name, a broken link and a version mismatch.claude plugin validate .passes. The one warning is about the contributorCLAUDE.mdat the repo root, which plugins don't load; that's expected.npx skills add . --listfinds 23 skills.Reviewers
.github/workflows/) needs@contentstack/security-admin, per CODEOWNERS.developbranch. It was created while setting this up, and the branch ruleset prevents deleting it.🤖 Generated with Claude Code