Skip to content

Release 0.4.1 - #34

Open
timbenniks-contentstack wants to merge 16 commits into
mainfrom
next
Open

timbenniks-contentstack wants to merge 16 commits into
mainfrom
next

Conversation

@timbenniks-contentstack

@timbenniks-contentstack timbenniks-contentstack commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Releases next to main as 0.4.1. Full notes are in the 0.4.1 changelog section.

Highlights

No skills were renamed or removed. node scripts/validate.mjs passes for 33 skills and 7 manifests at version 0.4.1.

After merge

Tag v0.4.1 on the merge commit and publish a GitHub release whose body is the 0.4.1 changelog section.

🤖 Generated with Claude Code

timbenniks-contentstack and others added 14 commits October 29, 2026 13:08
…outing evals

Accuracy: correct skill claims against the product wiki, using the public
docs and OpenAPI specs as tiebreaker (webhook signatures, taxonomy
operators, Launch PUT and deployment logs, release limits, branch scoping,
Brand Kit dials and headers, persistence-plugin name, and more). Fill in
the empty cms-entries and cms-variants-personalization instructions.

New skills: personalize, lytics, launch-platform, automations, dx-cli,
dx-mcp-server (local server and MCP Profile Hub), cms-graphql,
cms-json-rte and marketplace-apps.

Template: every SKILL.md uses the same sections (When to use, Before you
answer, Instructions, MCP tools, Output, Security, References, Examples),
enforced by scripts/validate.mjs. Each skill lists the Contentstack MCP
tools that carry out its steps, from the server's published tool
definitions, and stays advisory unless the user asks for the change.

Routing evals: 62 claude plugin eval cases in evals/ check that prompts
load the right skill and not its neighbour, run in CI on PRs that touch
skills.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…gent-skills into studio/sync-sdk-2.0

Resolve version conflicts: ship Studio SDK 2.0 changes as 0.3.1 on top of released 0.3.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix all 39 issues from the Studio skill audit (Next.js 16, studio-react
2.0.1): primitive-library plan step, one Section-per-region rule, preview
hash reset in resolveComposition, field projection and image bindings,
Section Slot node shape, SDK 2.0.1 registration snippets, catch-all and
no-Delivery-SDK install paths, canonical list recipe, wire-shape table,
compositions CT as JSON, MCP snapshot/scope, and consistency fixes.

Add two guides: csr-and-ssr-requirements and handle-404-pages, routed
from skills-index. Snippets typechecked against studio-react 2.0.1 and
live-preview-utils 4.5.3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
upgrade-studio-sdk: separate what 2.0 actually changed (verified by
installing 1.9.0 and 2.0.1 side by side) from older rules that behave the
same on both, and stop pointing at CHANGELOG files the npm packages don't
ship. wire-studio-state: state APIs need studio-react 1.8.0+.
discover-sections-from-ct: built-in type name `text`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
studio: sync with Studio SDK 2.0, fix end-to-end audit issues, add CSR/SSR and 404 guides (0.3.1)
Bring in the updated drafts: isCompositionNotFound in every 404 branch,
cache() for one fetch per request, the canvas note on unpublished
templates, builder-mode stackDetails requirements, init .catch, the
?builder=true handshake check, and the first-instance rule for a second
init (all verified against live-preview-utils 4.5.3).

Keep the SDK fixes from review: clear the shared stack's preview hash
before each SSR fetch, refetchSpec fallback for freeform compositions on
studio-react 2.0.1, typed snippets (tsc strict passes), and
isCompositionNotFound on the CSR route.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
studio: update CSR/SSR and 404 guides with latest drafts
Installing the plugin now gives the agent the skills and the Contentstack
tools together, from the hosted server at
https://mcp-profile-hub.contentstack.com/api/mcp (OAuth in the browser on
first use, no API key, the user's own roles).

Each client reads its own file, in the format its docs define (checked
3 Nov 2026):
- Claude Code / claude.ai: .mcp.json, type http.
- Codex, ChatGPT and Agent Plugins clients: mcp.json, type streamable-http
  with the agent-plugins.org schema.
- Cursor: inline mcpServers in .cursor-plugin/plugin.json (url only), which
  overrides Cursor's default mcp.json discovery.
- Gemini CLI: mcpServers in gemini-extension.json, httpUrl.

Also adds the docs, support, privacy and terms URLs to the Claude manifest:
claude plugin validate flags a plugin that connects to a remote MCP server
without a privacy policy. Ships in 0.3.1, which is on next and not yet released.

Verified: node scripts/validate.mjs passes; claude plugin validate passes with
the same two warnings as before (no icon, root CLAUDE.md).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: bundle the Contentstack MCP Profile Hub server with every plugin
Neither 0.3.1 nor 0.4.0 was released, so both changelog sections are
combined into 0.4.1 and every manifest is bumped to 0.4.1. Keeps the MCP
Profile Hub server config from next in gemini-extension.json and the
111-file Studio count in the README.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat: 0.4.1 — accuracy pass, new skills, one template, MCP pairing, routing evals
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@snyk-io

snyk-io Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Nov 3, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@github-actions

github-actions Bot commented Nov 3, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

- Add a 512x512 icon at assets/icon.png, referenced as `icon` (Claude)
  and `logo` (Cursor). Clears the Claude validator's ICON_MISSING
  warning; the directory locks the icon on first portal save.
- Add homepage, repository, license and keywords to the Cursor manifest.
- Refresh every manifest description to name the MCP server and the
  newer products.
- Remove a committed .pyc from migration-companion (binaries are held
  for directory review) and ignore __pycache__/ and *.pyc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 3, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants