feat: 0.4.1 — accuracy pass, new skills, one template, MCP pairing, routing evals

.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
       "name": "contentstack-skills",
       "source": "./",
       "description": "Contentstack agent skills for CMS modeling, Delivery SDK, Live Preview, Studio, Brand Kit, Developer Hub apps, Launch, and migrations.",
-      "version": "0.3.1",
+      "version": "0.4.1",
       "category": "development",
       "tags": ["contentstack", "cms", "headless-cms", "studio"]
     }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "contentstack-skills",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "Contentstack agent skills for CMS modeling, Delivery SDK, Live Preview, Studio, Brand Kit, Developer Hub apps, Launch, and migrations.",
   "author": { "name": "Contentstack", "url": "https://www.contentstack.com" },
   "homepage": "https://developers.contentstack.com",

.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "contentstack-skills",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "Contentstack agent skills for CMS modeling, Delivery SDK, Live Preview, Studio, Brand Kit, Developer Hub apps, Launch, and migrations.",
   "author": { "name": "Contentstack", "url": "https://www.contentstack.com" },
   "skills": "./skills/",

.github/workflows/routing-evals.yml

@@ -0,0 +1,46 @@
+name: Routing evals
+
+# Checks that each prompt in evals/ loads the right skill. Each run is a real Claude session
+# (about $0.10-0.15), so this runs once per case on PRs that touch skills or evals.
+on:
+  pull_request:
+    paths: ["skills/**", "evals/**"]
+  workflow_dispatch:
+    inputs:
+      runs:
+        description: Runs per case
+        default: "3"
+
+permissions:
+  contents: read
+
+jobs:
+  routing:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+    steps:
+      - name: Skip without an API key
+        if: env.ANTHROPIC_API_KEY == ''
+        run: echo "::notice::ANTHROPIC_API_KEY is not set (forks and Dependabot PRs), so routing evals were skipped."
+      - uses: actions/checkout@v4
+        if: env.ANTHROPIC_API_KEY != ''
+      - uses: actions/setup-node@v4
+        if: env.ANTHROPIC_API_KEY != ''
+        with:
+          node-version: 22
+      - name: Install Claude Code
+        if: env.ANTHROPIC_API_KEY != ''
+        run: npm install -g @anthropic-ai/claude-code
+      - name: Run routing evals
+        if: env.ANTHROPIC_API_KEY != ''
+        run: >-
+          claude plugin eval . --tag routing --ablation none
+          --runs ${{ inputs.runs || '1' }} -j 6 --max-cost-usd 40
+          --trust-plugin --no-publish --json evals/results/routing.json
+      - uses: actions/upload-artifact@v4
+        if: always() && env.ANTHROPIC_API_KEY != ''
+        with:
+          name: routing-evals
+          path: evals/results/

.gitignore

@@ -1,2 +1,3 @@
 .DS_Store
 .obsidian
+evals/results/

CHANGELOG.md

@@ -2,7 +2,59 @@
 
 All notable changes to the Contentstack agent skills bundle. Versions match the `version` field in every plugin manifest that declares one.
 
-## 0.3.1
+## 0.4.1
+
+### New skills
+
+- `personalize`: experiences, audiences, attributes and events, the Personalize Edge SDK and Edge API, the Management API, and edge middleware that resolves variants before rendering.
+- `lytics`: the Lytics JavaScript tag, identity resolution, schema, audiences and the Segment API, consent and deletion, and sending audiences to Personalize.
+- `launch-platform`: hosting on Launch, covering builds, Cloud and Edge Functions, `launch.json`, caching and revalidation, deploy hooks, domains, access control, log targets, monorepos and limits.
+- `automations`: Contentstack Automate rules, triggers, connectors, control flow, custom code, executions and debugging.
+- `dx-cli`: the `csdx` CLI for auth, export, import, seed, clone, bulk operations, migration scripts, branch merges and plugins.
+- `dx-mcp-server`: connecting AI agents through the local `@contentstack/mcp` server or the hosted MCP Profile Hub, and when to use each.
+- `cms-graphql`: the GraphQL Content Delivery API, covering endpoints, schema, references, modular blocks, JSON RTE, limits and Live Preview.
+- `cms-json-rte`: rendering and serializing JSON Rich Text Editor content with `@contentstack/utils`, render options, embedded entries and assets, GraphQL, React, HTML↔JSON conversion and Live Preview tags.
+- `marketplace-apps`: choosing, installing and configuring first-party Marketplace apps, app configuration vs field configuration, and reading app data on delivery.
+
+### One template, paired with MCP
+
+- **Every skill uses the same sections:** When to use, Before you answer, Instructions, MCP tools, Output, Security, References, Examples. `scripts/validate.mjs` now rejects missing, extra or out-of-order sections. The duplicated Description, User Problem, Success Criteria, Expected Inputs/Outputs, Workflow Summary, Tooling Notes and Product Context blocks are folded in, so the existing skills are about 770 lines shorter. See `docs/contributing/skill-template.md`.
+- **Routing cues:** each skill's When to use ends with the neighbouring skills to use instead, and many descriptions gained a "For X, use Y." cue.
+- **MCP tools in every skill:** each skill names the Contentstack MCP tools (from the local server's published definitions) that carry out its steps, or says that none exist and what to use instead. Skills stay advisory by default; they use write, publish, deploy or delete tools only when asked, after naming the target and getting confirmation.
+- **Launch action skills** use the `launch` MCP tools (`update_an_environment`, `create_deployment`, `get_deployment_logs`) when they're connected.
+- **`developer-hub-app-architect`:** links to its one coding reference instead of reference files that didn't exist.
+
+### Contributors
+
+- **Routing evals:** `evals/` holds 62 `claude plugin eval` cases, two or more per automatically invoked skill. Each checks that a prompt loads the right skill and, for close neighbours, doesn't load the wrong one. `.github/workflows/routing-evals.yml` runs them on PRs that touch `skills/` or `evals/` (needs an `ANTHROPIC_API_KEY` secret). See `docs/contributing/routing-evals.md`.
+
+### Accuracy pass against the product wiki and public docs
+
+- **`cms-webhooks`:** signature verification now uses `X-Contentstack-Request-Signature` (RSA-PSS SHA-256) or the opt-in `X-Contentstack-HMAC-Signature` over `{timestamp}.{body}`. Payload fields, workflow events, retry timing and branch scoping are corrected, and unverified limits are removed.
+- **`cms-taxonomy`:** the CDA operators are now the documented `$in`, `$exists`, `$eq_below`, `$below`, `$eq_above` and `$above` (with `levels`), replacing operators that don't exist. Depth and plan limits are added.
+- **`launch-sync-environment-variables-from-env-example`:** updates go through `PUT` with the full environment object (there is no PATCH), with regional hosts and auth.
+- **`launch-trigger-and-monitor-launch-deployments`:** logs come from the deployment-logs endpoint, the status list is complete with `LIVE` as success, and rollback is added.
+- **`brand-kit-assistant`:**
+  - Voice Profile dials are 1–4.
+  - Request headers are corrected.
+  - v2 kits (Documents) and the other Brand Kit surfaces are added.
+- **`cms-branches-aliases`:** the branch limit is plan-dependent, module scoping follows the public docs, and compare and merge strategies are added.
+- **Other CMS skills:**
+  - `cms-localization`: Unlocalize is documented.
+  - `cms-releases`: 25 items per request, plus Releases v2.
+  - `cms-roles-permissions`: permissions are a union of roles with no deny, and M2M apps are covered.
+  - `cms-workflows`: self-advancement prevention is a per-stage option.
+  - `cms-assets`: Assets DAM limits and routing are added.
+  - `cms-environments-publishing`: all CDA hosts and the rate-limit split are listed.
+  - `cms-tokens-authentication`: M2M apps and preview tokens are covered.
+- **`cms-entries` and `cms-variants-personalization`:** both now have real instructions; before, they were empty.
+- **`cms-data-modeling-best-practices`:** adds the limits to design around.
+- **`developer-hub-app-architect`:**
+  - Adds the Content Type Sidebar and Global Full Page locations.
+  - Covers M2M apps, lifecycle webhooks and per-installation secrets.
+- **`dx-delivery-sdk` and `dx-migrate-js-to-ts-sdk`:** the Security sections copied from Launch are replaced, and the package name is now `@contentstack/persistence-plugin`.
+- **`asset-management`:** user-defined field types match the current docs.
+- **Formatting:** instructions that were raw JSON are now prose, and the broken Product Context bullets are fixed.
 
 ### Contentstack MCP server bundled with the plugin
 

README.md

@@ -1,6 +1,6 @@
 # Contentstack Skills
 
-A bundle of ready-to-use [Contentstack](https://www.contentstack.com) agent skills for AI coding tools, covering CMS implementation, Brand Kit guidance, delivery SDK development, kickstart maintenance, migration workflows, Developer Hub app architecture, Launch automation, and Contentstack Studio.
+A bundle of ready-to-use [Contentstack](https://www.contentstack.com) agent skills for AI coding tools, covering CMS implementation, GraphQL delivery, Brand Kit guidance, delivery SDK development, the CLI and MCP servers, kickstart maintenance, migration workflows, Developer Hub app architecture, Marketplace apps, JSON RTE rendering, Launch hosting and automation, Personalize, Lytics, Automate, and Contentstack Studio.
 
 ## What's in here?
 
@@ -71,12 +71,15 @@ If you only want the skills, disable the `contentstack` MCP server in your tool'
 | Slug | Title | Product | What it helps with |
 | --- | --- | --- | --- |
 | `asset-management` | Asset Management | Assets | Assets DAM spaces and workspaces, folders, asset types and metadata, localization, saved views, AI tagging and alt text, duplicate management, versions, trash and restore, visual markups, and CMS integration. |
+| `automations` | Automations | Automate | Contentstack Automate workflows: triggers, connectors and connected apps, If-Else and loops, custom code, HTTP responses, executions and debugging, limits, and agent integration. |
 | `brand-kit-assistant` | Brand Kit Assistant | Brand Kit | Brand Kit concepts, setup, governance, Voice Profiles, Knowledge Vault, on-brand AI generation, and API-task routing. |
 | `cms-assets` | Contentstack Assets | CMS | Asset organization, image transformations, publishing lifecycle, CDN behavior, and asset limits. |
 | `cms-branches-aliases` | Branches & Aliases | CMS | Isolated content development, alias-based deployments, CI/CD integration, merge behavior, and rollback patterns. |
 | `cms-data-modeling-best-practices` | Contentstack Data Modeling Best Practices | CMS | Content type design, references, global fields, groups, modular blocks, JSON RTE, taxonomy, tags, and model simplification. |
 | `cms-entries` | Entries | CMS | Entry querying, localization, versioning, publishing, CDA usage, reference expansion, pagination, bulk operations, and Sync API patterns. |
 | `cms-environments-publishing` | Contentstack Environments & Publishing | CMS | Environment setup, publishing behavior, delivery and preview tokens, Sync API usage, CDN behavior, and publish queues. |
+| `cms-graphql` | GraphQL Content Delivery | CMS | GraphQL Content Delivery API endpoints and headers, generated schema, reference connections, modular blocks, JSON RTE, pagination, query and rate limits, and Live Preview with GraphQL. |
+| `cms-json-rte` | JSON Rich Text Editor | CMS | Rendering and serializing JSON RTE content with `@contentstack/utils`, custom render options, embedded entries and assets, HTML↔JSON conversion, and Live Preview tags. |
 | `cms-live-preview-visual-editor-support-assistant` | Live Preview and Visual Editor Support Assistant | Developer Experience | Live Preview, Visual Editor (Visual Builder) and Timeline setup or debugging: Onboarding Check, rendering-mode contracts (CSR, SSR, SSG, GraphQL), edit tags, FAQ-backed fixes, and Support handover. |
 | `cms-localization` | Contentstack Localization | CMS | Language setup, fallback chains, localized and unlocalized entries, non-localizable fields, and multi-locale publishing. |
 | `cms-releases` | Releases | CMS | Coordinated content deployment, release scheduling, staged deployment, webhook storm prevention, and CI/CD integration. |
@@ -87,12 +90,18 @@ If you only want the skills, disable the `contentstack` MCP server in your tool'
 | `cms-webhooks` | Contentstack Webhooks | CMS | Webhook configuration, event channels, payload handling, signature verification, retries, and reliable receiver design. |
 | `cms-workflows` | Workflows & Publish Rules | CMS | Workflow stages, approval flows, transition restrictions, publish governance, automation hooks, and common pitfalls. |
 | `developer-hub-app-architect` | Developer Hub App Architect | Developer Hub | Developer Hub and Marketplace app planning, UI location choices, React/TypeScript scaffolding, setup, SDK, manifest, proxy, and publishing issues. |
+| `marketplace-apps` | Marketplace Apps | Developer Hub | Choosing, installing and configuring first-party Marketplace apps (DAM, commerce, search, translation and more), and reading their field data on delivery. |
+| `dx-cli` | Contentstack CLI | Developer Experience | The `csdx` CLI: region and login, token aliases, export, import, seed and clone, bulk operations, migration scripts, branch diff and merge, and plugins such as tsgen, apps and Launch. |
 | `dx-delivery-sdk` | Delivery SDK | Developer Experience | Production-ready TypeScript with `@contentstack/delivery-sdk` for entries, assets, references, filters, sorting, pagination, locales, Live Preview, and Visual Builder. |
 | `dx-kickstart-next` | Contentstack Kickstart Next | Developer Experience | Maintaining Contentstack's Next.js kickstart: App Router structure, Delivery SDK setup, Live Preview, seeded stack alignment, env vars, validation, and PR reviews. |
+| `dx-mcp-server` | Contentstack MCP | Developer Experience | Connecting AI agents with the local `@contentstack/mcp` server or the hosted MCP Profile Hub: choosing, client setup, auth, tool groups and profiles, and least-privilege safety. |
 | `dx-migrate-js-to-ts-sdk` | Migrate JS to TS SDK | Developer Experience | Migration from the JavaScript Contentstack SDK to the TypeScript Delivery SDK, including API mapping, rewrites, and unsupported pattern callouts. |
-| `launch-sync-environment-variables-from-env-example` | Sync Launch environment variables from .env.example | Launch | Comparing a local `.env.example` with Launch environment variables and patching missing keys without printing secrets. |
+| `launch-platform` | Launch Platform | Launch | Hosting on Launch: frameworks and builds, Cloud and Edge Functions, launch.json routing, caching and revalidation, deploy hooks, domains, access control, log targets, monorepos, and limits. |
+| `launch-sync-environment-variables-from-env-example` | Sync Launch environment variables from .env.example | Launch | Comparing a local `.env.example` with Launch environment variables and adding missing keys with a full-object update, without printing secrets. |
 | `launch-trigger-and-monitor-launch-deployments` | Trigger and Monitor Launch Deployments | Launch | Triggering Launch deployments, polling deployment status, retrieving failure logs, and summarizing likely causes and next steps. |
+| `lytics` | Lytics | Lytics (Data & Insights) | Lytics projects, the JavaScript tag, identity resolution, schema and LQL, audiences and the Segment API, content affinity, consent and deletion, and connecting audiences to Personalize. |
 | `migration-companion` | Contentstack Migration Companion | Developer Experience | Guided Contentful-to-Contentstack migration workflow covering prerequisites, content migration, code migration, bundled validation scripts, and completion reporting. |
+| `personalize` | Personalize | Personalize | Experiences, audiences, attributes, impressions and conversions, the Personalize Edge SDK and Edge API, Management API, and edge middleware patterns that resolve variants before rendering. |
 | `studio` | Studio (preview) | Studio | Contentstack Studio end to end: SDK install, project provisioning, component registration, sections and templates, data binding, canvas and preview routes, verification, and troubleshooting. A router skill that loads one of 111 bundled specialist files per task. |
 
 ## How it works

docs/README.md

@@ -43,15 +43,17 @@ Every skill is written once in the open [Agent Skills](https://agentskills.io) f
 ### Contributing
 
 - [Add or edit a skill](contributing/add-or-edit-a-skill.md)
+- [Skill template](contributing/skill-template.md)
+- [Routing evals](contributing/routing-evals.md)
 - [Authoring conventions](contributing/authoring-conventions.md)
 - [Release & versioning](contributing/release-and-versioning.md)
 
 ## At a glance
 
 |                          |                                                                                                                |
 | ------------------------ | -------------------------------------------------------------------------------------------------------------- |
-| **Skills included**      | 24 (see the [skill reference](skills/index.md))                                                                |
-| **Products covered**     | CMS, Assets, Developer Experience, Studio, Launch, Brand Kit, Developer Hub                                    |
+| **Skills included**      | 33 (see the [skill reference](skills/index.md))                                                                |
+| **Products covered**     | CMS, Assets, Developer Experience, Studio, Launch, Brand Kit, Developer Hub, Marketplace, Personalize, Lytics, Automate |
 | **Supported tools**      | Claude Code, claude.ai / Cowork, Cursor, Codex, GitHub Copilot, Gemini CLI, `skills` CLI                       |
 | **Source of truth**      | `skills/<slug>/SKILL.md`                                                                                       |
 | **Repository**           | [github.com/contentstack/contentstack-agent-skills](https://github.com/contentstack/contentstack-agent-skills) |