Merged by github-maintain cron. Approved by @clark-cant and @jizc. Pre-existing pytest failure on main (ui-styling/shadcn test) is unrelated to PR scope.
Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
PR #296 (feat/emil-motion-principles) independently registers a "motion"
domain key in CSV_CONFIG/detect_domain for motion-principles.csv (37
design-principle rows). Both PRs adding the same dict key would cause
one to silently overwrite the other's domain registration if merged
independently, per the automated review on this PR.
The two domains are complementary, not duplicate (design principles vs.
ready-to-use GSAP code snippets), so this renames this PR's domain from
"motion" to "gsap" - a more precise name given every row is GSAP-specific
implementation code. The --motion CLI dial and its "Subtle/Standard/
Complex" tiers are unaffected (unrelated to the domain key; only the
`--domain gsap` search endpoint and its internal lookup changed). No
regressions: --design-system output with no dials set remains
byte-identical to before this feature.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a new searchable `motion` domain (motion.csv, 16 GSAP animation
skeletons across hover/scroll-reveal/stagger/page-transition/parallax/
loading, each tagged Subtle/Standard/Complex) plus three optional 1-10
dials on `--design-system` — --variance, --motion, --density — inspired
by taste-skill's DESIGN_VARIANCE/MOTION_INTENSITY/VISUAL_DENSITY sliders.
- --variance biases style search/selection toward centered-minimal (low)
or bold-asymmetric (high) categories
- --motion attaches a matching GSAP snippet (code + framework notes +
do/don't) from motion.csv
- --density overrides the --space-* token scale in ASCII/markdown/MASTER.md
output (spacious <-> dense/dashboard)
All three dials are optional and additive; output with no dials set is
byte-identical to before (verified via regression diff). Synced into
.claude/skills/ui-ux-pro-max and cli/assets alongside src/ui-ux-pro-max
(source of truth) so all three installed copies stay consistent.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix CLI asset sync
* fix(cli): normalize line endings in asset sync/check
check:assets hashed raw bytes, so identical CSV/JSON/py content with
CRLF vs LF (git autocrlf on checkout) was reported as stale drift,
blocking the release guard on Windows/mixed checkouts.
- fileHash now normalizes CRLF->LF before hashing, so check:assets
compares content, not line endings.
- sync:assets writes LF-normalized copies instead of a raw byte copy,
so re-syncing is deterministic across platforms.
All synced assets are text (csv/json/md/py); no binaries affected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci: enforce CLI asset sync on PRs
Adds a Check asset sync workflow that runs `npm run check:assets` on any
PR touching src/ui-ux-pro-max/** or cli/assets/**, so the bundled CLI
assets can't silently drift from the source of truth.
The check uses only node builtins (no install step) and normalizes
line endings before hashing, so it hard-fails on real content drift
without the CRLF/LF soft-fail hack other approaches needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Force UTF-8 encoding for stdout/stderr in search.py to handle
emoji characters (⚡, ✓) on Windows systems that default to cp1252.
Fixes UnicodeEncodeError: 'charmap' codec can't encode character
- Bump CLI version to 2.2.3
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
BREAKING CHANGES:
- Moved canonical data/scripts to src/ui-ux-pro-max/
- Removed duplicate folders (.codex/, .gemini/, .trae/, .codebuddy/, .continue/, skills/, .qoder/)
- CLI now uses template system instead of copying pre-built folders
New features:
- Merged prompts.csv into styles.csv with 4 new columns:
- AI Prompt Keywords
- CSS/Technical Keywords
- Implementation Checklist
- Design System Variables
- All 67 styles now have complete prompt data
- Added Astro stack (53 guidelines)
- Added 10 new 2025 UI trend styles
CLI changes:
- New template rendering system (cli/src/utils/template.ts)
- Reduced cli/assets from ~34MB to ~564KB
- Assets now contain only: data/, scripts/, templates/
File structure:
- src/ui-ux-pro-max/ - Single source of truth
- .claude/skills/ - Symlinks to src/ for development
- .shared/ - Symlink to src/ui-ux-pro-max/
Bumped CLI version: 2.1.3 → 2.2.0
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
