* fix(data): regenerate stale catalog-summary snapshot hashes
catalog-summary.json was not regenerated after google-fonts.csv,
google-font-licenses.json, icons.csv and phosphor-icons-upstream.json
changed, so `npm --prefix cli run verify:data` fails on a clean
checkout of main:
validate:semantic 4 stale snapshot errors
validate:catalog-summary "catalog-summary.json is stale"
test:python 1 failure / 153
check:assets 2 files out of sync
Regenerated with the existing --verified-at 2026-08-26: only the four
sha256 fields change. The date is a human attestation that the font
catalog was checked against the upstream google/fonts repository, so it
is deliberately left untouched -- no such verification was performed
here.
verify:data now exits 0.
Note: prepublishOnly runs sync:assets before verify:data, which
regenerates the snapshot at publish time. That is why released packages
are unaffected and the drift stayed invisible on main.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UidECV1wVBD8SW6Abuj71
* fix(data): make catalog snapshot hashes line-ending independent
Root cause of the stale snapshot restored in the previous commit.
bd19ab9 (#462) regenerated catalog-summary.json from a CRLF checkout.
Every recorded sha256 was the CRLF hash of its source file, so the
check failed on every LF platform. The four committed values are
exactly sha256(crlf_bytes):
google-fonts.csv committed d03194d2… = CRLF hash
google-font-licenses.json committed 7c35e410… = CRLF hash
icons.csv committed 272ccf0e… = CRLF hash
phosphor-icons-upstream.json committed 81c37fb3… = CRLF hash
Two conditions had to combine: the digest hashed raw bytes, and no
.gitattributes pinned these files to LF, so Windows checkouts get CRLF
by default. Restoring the hashes alone would let the next contributor
on Windows reproduce the same commit.
Three changes:
- normalize line endings in generate-catalog-summary.py's digest(), so
the snapshot no longer depends on the checkout
- apply the same normalization in validate_data.py, which independently
recomputes the hashes and has to agree with the generator
- add .gitattributes pinning src/ui-ux-pro-max/data/*.{csv,json} to LF,
so a Windows checkout matches the committed bytes in the first place
sync-assets.mjs already normalizes to LF, so this only extends an
existing project convention to the two places that were missing it.
Adds test_catalog_summary_line_endings.py: LF and CRLF inputs must
digest identically, the committed snapshot must match the normalized
sources, and a simulated CRLF checkout must still produce the recorded
hashes. The third case fails against the pre-fix digest.
verify:data exits 0; the Python suite goes from 153 to 156 tests.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UidECV1wVBD8SW6Abuj71
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Merged by github-maintain cron. Approved by @clark-cant and @jizc. Pre-existing pytest failure on main (ui-styling/shadcn test) is unrelated to PR scope.
Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
- add CSV structural validation and all-domain smoke tests
- repair malformed CSV rows in source and bundled CLI assets
- run data validation in CI and prepublish checks
- add npm build wrapper with TypeScript fallback when Bun is unavailable
- fix CLI asset resolution for TypeScript fallback builds
cli/assets had fallen out of sync with src/ui-ux-pro-max ahead of this
change (unrelated to the motion-domain feature) - colors.csv, products.csv,
google-fonts.csv, draft.csv, several platform templates, and sub-skill
scripts/tests had all drifted. Ran the project's own `sync-assets.mjs`
to bring cli/assets back in line with the source of truth per the
documented Sync Rules; `--check` now reports assets as in sync.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a new searchable `motion` domain (motion.csv, 16 GSAP animation
skeletons across hover/scroll-reveal/stagger/page-transition/parallax/
loading, each tagged Subtle/Standard/Complex) plus three optional 1-10
dials on `--design-system` — --variance, --motion, --density — inspired
by taste-skill's DESIGN_VARIANCE/MOTION_INTENSITY/VISUAL_DENSITY sliders.
- --variance biases style search/selection toward centered-minimal (low)
or bold-asymmetric (high) categories
- --motion attaches a matching GSAP snippet (code + framework notes +
do/don't) from motion.csv
- --density overrides the --space-* token scale in ASCII/markdown/MASTER.md
output (spacious <-> dense/dashboard)
All three dials are optional and additive; output with no dials set is
byte-identical to before (verified via regression diff). Synced into
.claude/skills/ui-ux-pro-max and cli/assets alongside src/ui-ux-pro-max
(source of truth) so all three installed copies stay consistent.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds WPF, WinUI 3, UWP, Avalonia, and Uno Platform stacks (17 -> 22 total),
each with its own guidelines CSV, registered in core.py and synced to cli/assets.
- New stack CSVs in src/ and cli/assets/data/stacks/
- search.py / core.py registry updated
- smoke-stacks.sh: EXPECTED_STACK_COUNT 21 -> 22 with a smoke-test workflow
- platform template descriptions and README bumped to 22 technology stacks
* fix CLI asset sync
* fix(cli): normalize line endings in asset sync/check
check:assets hashed raw bytes, so identical CSV/JSON/py content with
CRLF vs LF (git autocrlf on checkout) was reported as stale drift,
blocking the release guard on Windows/mixed checkouts.
- fileHash now normalizes CRLF->LF before hashing, so check:assets
compares content, not line endings.
- sync:assets writes LF-normalized copies instead of a raw byte copy,
so re-syncing is deterministic across platforms.
All synced assets are text (csv/json/md/py); no binaries affected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci: enforce CLI asset sync on PRs
Adds a Check asset sync workflow that runs `npm run check:assets` on any
PR touching src/ui-ux-pro-max/** or cli/assets/**, so the bundled CLI
assets can't silently drift from the source of truth.
The check uses only node builtins (no install step) and normalizes
line endings before hashing, so it hard-fails on real content drift
without the CRLF/LF soft-fail hack other approaches needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Breaking changes fixed:
- Row 8/9: icon format corrected from 'lucide:home' (v3) to 'i-lucide-home' (v4 Iconify i-prefix)
- Row 18: useOverlay API updated from .open(Component, {props}) to .create(Component).open({props})
New v4 guidelines added (rows 51-70):
- Auto-registered modules: do not re-add @nuxt/icon @nuxt/fonts @nuxtjs/color-mode
- Official nuxi init templates for project bootstrapping
- Local Iconify JSON install for SSR reliability
- Global icon overrides via appConfig.ui.icons
- New form components: UFileUpload, UInputDate, UInputTags, UColorPicker
- New data components: UTree, UMarquee
- UContextMenu for right-click menus
- Awaiting overlay result Promise for confirmation dialogs
- UCommandPalette grouped items and extractShortcuts
- UHeader/UFooter/UPageAside layout components
- ClientOnly pattern for color mode hydration safety
- Generated theme file (.nuxt/ui/) for slot discovery
- defineShortcuts whenever condition guard
- UApp locale prop for i18n (50+ built-in locales)
Sync cli/assets to match src.
- Merged STACK_CONFIG: kept main's full stack list + added angular & laravel from PR
- Updated platform templates: 161 palettes, 16 stacks across all descriptions
- Listed all 16 stacks in claude.json frontmatter description
BREAKING CHANGES:
- Moved canonical data/scripts to src/ui-ux-pro-max/
- Removed duplicate folders (.codex/, .gemini/, .trae/, .codebuddy/, .continue/, skills/, .qoder/)
- CLI now uses template system instead of copying pre-built folders
New features:
- Merged prompts.csv into styles.csv with 4 new columns:
- AI Prompt Keywords
- CSS/Technical Keywords
- Implementation Checklist
- Design System Variables
- All 67 styles now have complete prompt data
- Added Astro stack (53 guidelines)
- Added 10 new 2025 UI trend styles
CLI changes:
- New template rendering system (cli/src/utils/template.ts)
- Reduced cli/assets from ~34MB to ~564KB
- Assets now contain only: data/, scripts/, templates/
File structure:
- src/ui-ux-pro-max/ - Single source of truth
- .claude/skills/ - Symlinks to src/ for development
- .shared/ - Symlink to src/ui-ux-pro-max/
Bumped CLI version: 2.1.3 → 2.2.0
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
