* fix: V-001 security vulnerability
Automated security fix generated by Orbis Security AI
* feat(cli): add optional GitHub token support with proper UX and docs
- Rename env var from GITHUB_TOKEN to UI_PRO_MAX_GITHUB_TOKEN (primary),
with GITHUB_TOKEN as fallback — avoids silently attaching CI workflow
credentials that GitHub Actions injects automatically
- Add whitespace trim guard to prevent malformed Authorization headers
- Add getGitHubTokenGuidance() helper exported from github.ts so rate-limit
errors and spinner warnings tell users exactly how to fix the problem
- Thread optional token param through fetchReleases, getLatestRelease,
downloadRelease signatures
- Add --token flag to init, versions, update commands (Commander.js wiring)
- Update rate-limit catch in tryGitHubInstall to show token guidance
- Document token options (flag, env var, fallback) in cli/README.md with
CI warning about GITHUB_TOKEN scope
Supersedes the narrower env-only approach in PR #294 and incorporates the
safeguards requested during review of closed PR #186.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The --force option was accepted by Commander but ignored: writeFile()
always overwrote existing files silently. Users expecting protection
against accidental overwrites had no way to preserve existing configs.
- generatePlatformFiles: check file existence before writing; skip with
a clear message when file exists and force=false
- generateAllPlatformFiles / templateInstall: propagate force parameter
- initCommand: pass options.force through to templateInstall
Behavior change:
uipro init --ai claude → skips if SKILL.md already exists
uipro init --ai claude --force → overwrites regardless
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
- Warn when --global and --legacy are used together (init.ts)
- Update metadata across all platform templates (161 palettes, 15 stacks)
- Bump skill.json version from 2.0.0 to 2.5.0
- Re-throw non-ENOENT errors in uninstall.ts removeSkillDir
- Hoist detectAIType call to avoid double invocation in uninstall
- Add clarifying comment for .shared in AI_FOLDERS mapping
BREAKING CHANGES:
- Moved canonical data/scripts to src/ui-ux-pro-max/
- Removed duplicate folders (.codex/, .gemini/, .trae/, .codebuddy/, .continue/, skills/, .qoder/)
- CLI now uses template system instead of copying pre-built folders
New features:
- Merged prompts.csv into styles.csv with 4 new columns:
- AI Prompt Keywords
- CSS/Technical Keywords
- Implementation Checklist
- Design System Variables
- All 67 styles now have complete prompt data
- Added Astro stack (53 guidelines)
- Added 10 new 2025 UI trend styles
CLI changes:
- New template rendering system (cli/src/utils/template.ts)
- Reduced cli/assets from ~34MB to ~564KB
- Assets now contain only: data/, scripts/, templates/
File structure:
- src/ui-ux-pro-max/ - Single source of truth
- .claude/skills/ - Symlinks to src/ for development
- .shared/ - Symlink to src/ui-ux-pro-max/
Bumped CLI version: 2.1.3 → 2.2.0
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add GitHubRateLimitError and GitHubDownloadError for better error handling
- Detect rate limits (403 with remaining=0, 429)
- Try downloading from GitHub releases first
- Fall back to bundled assets on network error, rate limit, or download failure
- Add --offline flag to skip GitHub download
- Use GitHub auto-generated archive URL as fallback when no ZIP asset exists
- Update CLI to v1.9.0
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add assets folder with all skill files (.claude, .cursor, .windsurf, .agent, .shared)
- Simplify init command to copy from bundled assets instead of GitHub download
- Remove --version option (version tied to npm package)
- No more GitHub API rate limits
- Works offline
- Bump to v1.1.0
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
