Skip to content

Release 0.3.0: asset-management skill and support-assistant fixes - #26

Merged
timbenniks-contentstack merged 13 commits into
mainfrom
next
Oct 23, 2026
Merged

timbenniks-contentstack merged 13 commits into
mainfrom
next

Conversation

@timbenniks-contentstack

Copy link
Copy Markdown
Contributor

Brings next to main for the 0.3.0 release. All five manifests are at 0.3.0, and CHANGELOG.md has the 0.3.0 section.

New skill: asset-management (#24)

Advisory guidance for the standalone Assets (DAM) product: spaces and workspaces, folders, asset types and user-defined fields, localization, saved views, Assets API search, AI tags and alt text, duplicates, versions, trash and restore, visual markups and CMS integration.

  • Search: describes the public Assets API search endpoint with the four regional hosts, the required headers (OAuth bearer token, or authtoken plus organization_uid; management tokens are not accepted) and spaces as a plain array of space UIDs.
  • Documented behavior only: the search guidance sticks to what the public docs cover: nested $and/$or, and filters that match a field to a value. The undocumented operator list and the $regex line are gone. The skill tells users to test filters on user-defined fields, since the public page doesn't cover them.
  • Routing: cms-assets is now scoped to the stack asset library. Assets DAM questions, and any request to read or update user-defined fields, route to asset-management.
  • Docs: README table row, docs/skills/asset-management.md, the skill index, the router and introduction pages, and the skill count (24).

Support-assistant fixes (#25, replaces #23)

Eight fixes to cms-live-preview-visual-editor-support-assistant that missed 0.2.0, by @hitesh-shetty-cstk. #23 came from a fork, so its security checks couldn't get repo secrets. The commit was cherry-picked into #25 with his authorship intact.

  • Open in New Tab is scoped to Live Preview everywhere. Visual Editor always renders in its canvas iframe.
  • The missing navigation entry checks the stack's Live Preview setting first.
  • The CORS entry drops an unverified allowlist claim and notes that curl doesn't enforce CORS.
  • GraphQL preview keeps the access_token and Content-Type headers. The preview headers are added to them, not swapped in.
  • livePreviewQuery: live_preview is the only required key, and both snake_case and camelCase key spellings work.
  • The edit button's exclude config only applies through init().
  • SDK caching is separated from app and CDN caching.
  • stackSdk notes for the legacy SDK.

Checks

🤖 Generated with Claude Code

Mun-GitHub and others added 13 commits October 12, 2026 16:15
Advisory skill covering spaces and workspaces, folders, asset types and
metadata, AI tags and alt text, duplicate management, versions, trash
and restore, visual markups, image editing, and CMS integration.
Registered in the router, README and manifest; cursor rules and codex
tree regenerated.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Remove image editing section, restrict user-defined field types to
single line text, number, select and group, and add localization and
saved views guidance. Regenerated cursor rules and codex tree.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Drop the generated cursor/codex trees, manifest.json and skills/CLAUDE.md
router (removed on main). Register asset-management the new way: README
row, docs/skills page and index entry. Add Use when trigger and the
Environment Variables security subsection required by the validator.
…fix docs and routing

- Rewrite the search section against the public Assets API search page
  (host, path, headers, search_field values, query operators)
- Say 'currently supported' for user-defined field types
- Add asset-management to docs/overview/introduction.md and
  docs/how-it-works/router.md; fix product count
- Point cms-assets at asset-management for DAM questions
- Remove leftover 'editing' from the workflow summary

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The stack asset library does not support user-defined fields. Say so in
cms-assets and its docs page, and point asset-management at the Assets API.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…vars; bump to 0.3.0

- spaces is a plain array of UIDs; list regional hosts and flag the .io/.com mismatch
- Use authtoken/OAuth env vars, not a management token
- Match 'currently supported' field-type wording in the docs page
- Fix docs/README.md table padding
- Bump version to 0.3.0 in all manifests and add a CHANGELOG entry

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- List the AWS NA host (am-api.contentstack.com), now consistent in the docs
- Drop the undocumented operator list and $regex claim; use the documented field-value form
- Flag user-defined field paths as something to test against the space
- Clarify that the organization UID pairs with the authtoken

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(skills): add asset-management skill for the Assets DAM product
…erge

These were made on the original branch after it was folded into the
0.2.0 release, so they did not reach it:

- Open in New Tab is scoped to Live Preview; Visual Editor does not
  support it and always renders in its canvas iframe.
- Missing Visual Experience navigation checks the stack's Live Preview
  setting before treating it as provisioning.
- The CORS entry no longer rules out a Contentstack-side cause, and its
  verification says curl does not enforce CORS.
- GraphQL preview requests keep access_token and Content-Type.
- livePreviewQuery: live_preview is the only required key and an empty
  one resets the instance; both key spellings are accepted.
- The editButton exclude config applies only where init() runs.
- Cache guidance separates app and CDN caches from SDK caching and says
  the hash rotates on a timer rather than on edits.
- The framework examples say which stackSdk to pass per Delivery SDK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rty scripts; changelog

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fix(skills): port remaining support-assistant fixes after 0.2.0
@timbenniks-contentstack
timbenniks-contentstack requested a review from a team as a code owner October 23, 2026 10:17
@snyk-io

snyk-io Bot commented Oct 23, 2026

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@timbenniks-contentstack
timbenniks-contentstack merged commit 18cc82e into main Oct 23, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants