* fix(data): regenerate stale catalog-summary snapshot hashes
catalog-summary.json was not regenerated after google-fonts.csv,
google-font-licenses.json, icons.csv and phosphor-icons-upstream.json
changed, so `npm --prefix cli run verify:data` fails on a clean
checkout of main:
validate:semantic 4 stale snapshot errors
validate:catalog-summary "catalog-summary.json is stale"
test:python 1 failure / 153
check:assets 2 files out of sync
Regenerated with the existing --verified-at 2026-08-26: only the four
sha256 fields change. The date is a human attestation that the font
catalog was checked against the upstream google/fonts repository, so it
is deliberately left untouched -- no such verification was performed
here.
verify:data now exits 0.
Note: prepublishOnly runs sync:assets before verify:data, which
regenerates the snapshot at publish time. That is why released packages
are unaffected and the drift stayed invisible on main.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UidECV1wVBD8SW6Abuj71
* fix(data): make catalog snapshot hashes line-ending independent
Root cause of the stale snapshot restored in the previous commit.
bd19ab9 (#462) regenerated catalog-summary.json from a CRLF checkout.
Every recorded sha256 was the CRLF hash of its source file, so the
check failed on every LF platform. The four committed values are
exactly sha256(crlf_bytes):
google-fonts.csv committed d03194d2… = CRLF hash
google-font-licenses.json committed 7c35e410… = CRLF hash
icons.csv committed 272ccf0e… = CRLF hash
phosphor-icons-upstream.json committed 81c37fb3… = CRLF hash
Two conditions had to combine: the digest hashed raw bytes, and no
.gitattributes pinned these files to LF, so Windows checkouts get CRLF
by default. Restoring the hashes alone would let the next contributor
on Windows reproduce the same commit.
Three changes:
- normalize line endings in generate-catalog-summary.py's digest(), so
the snapshot no longer depends on the checkout
- apply the same normalization in validate_data.py, which independently
recomputes the hashes and has to agree with the generator
- add .gitattributes pinning src/ui-ux-pro-max/data/*.{csv,json} to LF,
so a Windows checkout matches the committed bytes in the first place
sync-assets.mjs already normalizes to LF, so this only extends an
existing project convention to the two places that were missing it.
Adds test_catalog_summary_line_endings.py: LF and CRLF inputs must
digest identically, the committed snapshot must match the normalized
sources, and a simulated CRLF checkout must still produce the recorded
hashes. The third case fails against the pre-fix digest.
verify:data exits 0; the Python suite goes from 153 to 156 tests.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UidECV1wVBD8SW6Abuj71
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(design-system): resolve project root from cwd, not __file__
fetch-background.py and html-token-validator.py derived PROJECT_ROOT with five
.parent hops, which only reaches the project root when the skill is vendored at
<project>/.claude/skills/design-system/scripts/. Installed at user level
(~/.claude/skills/) or as a plugin, PROJECT_ROOT pointed outside the project, so
both scripts silently ran against no tokens at all.
Resolve from the working directory instead, matching generate-tokens.cjs and
validate-tokens.cjs which already use process.cwd(). DESIGN_SYSTEM_PROJECT_ROOT
overrides it when the project root cannot be inferred.
slide_search_core.py is left alone: it resolves skill-relative data, which is
the correct use of __file__.
Refs #459
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(design-system): stop findProjectRoot from hanging on Windows
embed-tokens.cjs walked up the tree with `while (dir !== '/')`. On Windows the
filesystem root is 'C:\', so that condition is never true, and path.dirname('C:\')
returns 'C:\' unchanged -- the loop spins forever at 100% CPU instead of erroring
out, whenever assets/design-tokens.css is not found above the cwd.
Stop when dirname stops changing, which terminates on every platform.
Refs #459
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(design-system): force UTF-8 stdout so emoji output works on cp1252 consoles
search-slides.py --context and html-token-validator.py print emoji. On a Windows
console the default encoding is cp1252, so the first emoji raises
UnicodeEncodeError and the command dies with a traceback instead of output --
this takes out --context, the entry point of the contextual slide system.
Reuse the guard already shipped in src/ui-ux-pro-max/scripts/search.py.
Refs #459
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* test(design-system): decode subprocess output as UTF-8 in validate-tokens tests
test_validate_tokens.py drives validate-tokens.cjs through subprocess.run with
text=True but no explicit encoding, so Python decodes the pipe with the locale
codec. On Windows (cp1252) the validator's emoji output raises UnicodeDecodeError
inside the reader thread, result.stdout comes back as None, and the assertion
fails with a confusing `TypeError: argument of type 'NoneType' is not a
container` -- this suite cannot pass on Windows at all today.
Pin the pipe and the fixture write to UTF-8. The validator itself was never at
fault: run by hand it flags the hardcoded hex correctly.
Note: brand/scripts/tests/test_sync_brand_to_tokens.py uses the same
text=True-without-encoding pattern and is one emoji away from failing the same
way. Left alone to keep this PR scoped to design-system.
Refs #459
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
- replaced hardcoded python3 in npm scripts with a node wrapper to support windows natively without breaking unix systems
- updated stale catalog-summary.json snapshot
Co-authored-by: khietan <118370929+khietan@users.noreply.github.com>
Replace all 22 hard-coded ~/.claude/skills/design/scripts/... invocations
in the design skill with skill-relative paths (python3 scripts/...), the
same convention the brand and design-system sub-skills already use. The
user-level path only works in one install context: under a marketplace/
plugin install the skill lives in the plugin cache, and under project-level
CLI installs there is no ~/.claude/skills/design/ either.
Edited .claude/skills/design/SKILL.md (source of truth) and regenerated
the CLI copy with cli/scripts/sync-assets.mjs; --check passes.
Adds a path-contract step to check-asset-sync.yml that fails if any
SKILL.md (either copy) reintroduces a ~/.claude/skills/ invocation, and
widens the workflow's path filters to .claude/skills/** so the contract
actually fires on sub-skill edits.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Remove references to tools and sibling skills that are not bundled with banner-design. Add plugin, asset, and Claude CLI installation path-contract coverage.
GitHub renders Hangul with fallback font metrics that differ from
ASCII spacing. Replace right-bordered diagrams with borderless layouts
so alignment no longer depends on browser-specific font rendering.
test_sync_brand_to_tokens.py drives sync-brand-to-tokens.cjs through
subprocess.run with text=True but no explicit encoding, so Python decodes the
pipe with the locale codec. Three of the script's messages carry emoji whose
UTF-8 bytes land on cp1252's undefined slots: 0x8F in the "no base hex found"
warning (sync-brand-to-tokens.cjs:132), 0x9D in the "brand guidelines not found"
error (:198), and 0x8F in the dry-run notice (:223). Decoding then raises inside
subprocess's reader thread, the stream comes back as None, and any assertion
against it fails with `TypeError: argument of type 'NoneType' is not a
container` -- which hides the real result behind an unrelated error.
The existing test passes today only because the bundled starter fixture happens
to take none of those three paths.
Pin the pipe to UTF-8, extracted into a shared _run helper to match the idiom in
design-system's test module, and add a regression test for the missing-guidelines
path -- the default state of any project that has not run the brand skill yet.
That test fails without the encoding fix (stderr is None) and passes with it.
Follow-up to #460
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
droid's install root (.factory) doesn't match its platform
identifier, the same mismatch pattern already covered for codex
(.agents). Extends the existing test cases rather than adding new
assertions.
The manual cp commands only synced cli/assets/, skipping the
.claude/skills/ui-ux-pro-max/ mirror that the sync-assets tooling
also updates. Following the doc literally left that copy stale
and would fail the "Check asset sync" CI check. Use the actual
npm run sync:assets script (as documented in CLAUDE.md) instead.
The star history chart in README.md and README.zh.md is currently broken and fails to render because of GitHub stargazer API restrictions. Point the chart and its link to a working endpoint so visitors can still see the project's growth over time.
Clarify that the full repository archive is not a Claude.ai skill upload artifact and direct Claude Code users to the supported Marketplace and CLI installation paths.\n\nCloses #235.
Adds a workflow that triggers on release published, checks out main,
updates the version field in skill.json, marketplace.json, and plugin.json
to match the release tag, then opens a PR automatically.
* feat(cli): add --global flag to update command and support --ai universal (#435, #436)
* fix(cli): support dist package.json resolution in update command
Click any StyleCard to open a full-screen modal showing the style applied
to 9 interactive phone UI controls (buttons, inputs, toggles, checkboxes,
radios, cards, badges, slider, nav bar) inside an iPhone mockup frame.
Co-authored-by: yongtang <jlinux@msn.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(copilot): generate .prompt.md file for VS Code Copilot slash commands
VS Code Copilot requires reusable prompts to be files named
`<name>.prompt.md` directly in `.github/prompts/`. The previous
config generated `.github/prompts/ui-ux-pro-max/PROMPT.md` (a folder
with PROMPT.md inside), which is not recognized as a slash command.
Changes:
- copilot.json: set skillPath to 'prompts', filename to
'ui-ux-pro-max.prompt.md', add dataPath for data/scripts location
- copilot.json: use 'mode: agent' frontmatter (VS Code format) instead
of 'name' field
- template.ts: add dataPath support so data/scripts go to a separate
directory from the prompt file when configured
- template.ts: rewrite hardcoded script paths to platform-specific
scriptPath for platforms that differ from the default
- uninstall.ts: handle copilot-specific file layout during uninstall
After this fix, `uipro init --ai copilot` produces:
.github/prompts/ui-ux-pro-max.prompt.md (slash command file)
.github/prompts/ui-ux-pro-max/data/ (search database)
.github/prompts/ui-ux-pro-max/scripts/ (search engine)
* fix(copilot): apply prompt-file layout fix to canonical source template
Address review feedback on PR #328:
- Update src/ui-ux-pro-max/templates/platforms/copilot.json (source of
truth) with the same .prompt.md layout fix that was previously applied
only to the packaged CLI asset copy
- Sync cli/assets/templates/platforms/copilot.json byte-for-byte from
the source template (also fixes stale '15 technology stacks' count;
there are 16 stack CSVs)
Smoke check (uipro init --ai copilot --offline):
.github/prompts/ui-ux-pro-max.prompt.md (slash command, mode: agent)
.github/prompts/ui-ux-pro-max/data/ (search database)
.github/prompts/ui-ux-pro-max/scripts/ (search engine)
uninstall --ai copilot removes both the prompt file and data directory.
---------
Co-authored-by: vkayata <volkan.kayatas@mercedes-benz.com>
generate() ranked style, palette and anti-patterns independently, so a
dark-primary style could come back with a light palette and a
"Dark mode by default" anti-pattern in the same output. The palette is
what users copy into CSS variables, so the output shipped a light theme
with dark-theme styling instructions attached.
Resolve the mode first -- from the query keywords and the style's own
Light/Dark Mode columns -- then pick a palette whose Background matches
it and drop mode-contradicting anti-pattern clauses.
Only the dark case filters palettes. Light keeps the existing top-hit
behaviour so queries that never mention a mode are untouched, and dark
falls back to the top hit when colors.csv has no dark ramp for the
product type.
Adds scripts/tests/test_design_system_mode.py (stdlib unittest, matching
test_core.py) and syncs cli/assets + .claude/skills via sync-assets.mjs.
Step 1 of the workflow told the agent the stack was always React Native
("this project's only tech stack"), a leftover from the skill's origin as
a React Native project. In a generic skill this actively misleads: agents
pick React Native guidance for web, Flutter or desktop work, and skip the
matching `--stack` file entirely.
Replace it with stack inference plus an explicit platform question, and
point at the Available Stacks list so the right rules get loaded.
Also flags that several rule sections are scoped to App UI, so mobile-only
concerns (safe areas, haptics, bottom nav, Dynamic Type) are not applied
to desktop-web work.
Co-authored-by: decilapdenis <decilapdenis@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The description strings still reported 161 color palettes, 73 font
pairings, 99 UX guidelines, and 17 tech stacks -- numbers that predate
the current data set. README.md and .claude-plugin/plugin.json already
report the correct counts (192 palettes, 74 pairings, 98 guidelines,
22 stacks); this brings the two remaining stale files in line.
A ready-to-use Claude Code environment for website design, bundling:
- .mcp.json: Playwright + Chrome DevTools + shadcn MCP servers
- CLAUDE.md: the design loop (plan -> commit to a look -> build -> screenshot -> review)
- .claude/agents/design-review.md: 7-phase design-review subagent (WCAG AA, responsive)
- .claude/commands: /design-review, /design-plan
- scripts/design-audit.mjs: standalone multi-viewport screenshot + heuristic audit
- .github/workflows/design-review.yml: CI design gate (template)
- docs/: STACK, SETUP, WORKFLOW
- examples/juniper-audit/: a real audit run (report + 6 viewport screenshots)
Pairs with the ui-ux-pro-max skill (knowledge layer) and the official
frontend-design plugin (taste layer). Lives on its own branch as a
self-contained starter; copy stack/ out to seed a standalone repo.
Co-authored-by: Claude <noreply@anthropic.com>
Merged by github-maintain cron. Approved by @clark-cant and @jizc. Pre-existing pytest failure on main (ui-styling/shadcn test) is unrelated to PR scope.
Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
