v3.8.0

Added

• README: link to the docs site (qte77.github.io/claude-code-plugins), live since
  the Pages deploy fix (#214).
• planning (1.1.0): new triaging-issues skill (#179) — read-only GitHub issue triage: cluster
  by concern, score ROI × effort × risk from the actual code, output a P0–P3 plan with execution
  order, quick wins, and close candidates that each need file-level evidence. Ported from
  polyfetch-scrape's /analyze-issues.
• commit-helper (1.2.0): creating-pr-from-branch finds PR templates in any local location/case
  and falls back to the owner-level <owner>/.github default (#161) — GitHub applies that one only in
  the web UI, never to gh pr create --body.
• workspace-setup (1.5.4), workspace-sandbox (1.3.14): new shared rule ci-status-checks.md
  (#192) — clear a stuck CodeFactor: ERROR by updating the branch from main, never with empty
  "nudge" commits; never --admin-merge past a failing/absent check. Promoted from qte77/qte77
  AGENT_LEARNINGS.md (compound-learning step 3).
• docs-governance (1.6.2): frontmatter-convention rule gains an ADR Exception (MADR 3.x) —
  docs/adr/ uses ## More Information and bare - name: <url> sources (#160; upstreamed from
  doc-pipeline-engine's local carve-out).
• cc-meta (1.16.0): new cross-checking-research skill + bundled workflows/research-cross-check.js
  (#180) — bidirectional consumer-repo ↔ research-hub cross-check (pull cites/adoptions, push drafted
  findings). Paths are required args; no hardcoded repo defaults; read-only agents.
• Release workflows: bump-version.yaml, tag-release.yaml, publish-release.yaml call the
  shared qte77/.github reusables for the root marketplace version; .bumpversion.toml bumps
  metadata.version, the README badge, and rolls [Unreleased] into a dated section. See
  CONTRIBUTING.md "Releases". New make docs_stage target.
• web-recon (0.1.0): new plugin — web-recon skill drives the
  web-recon-kit harness for authorized web/API
  attack-surface assessment (passive enumeration, auth-posture matrix, BOLA/BFLA, cron checks),
  with a mandatory authorization gate.
• website-audit (1.2.3): verifying-design-canvas — trimmed the frontmatter description to
  the repo's 250-char cap (was 366), added a "Related skills" note distinguishing this
  verification skill from the built-in artifact-design/artifact-diagramming/
  artifact-capabilities creation skills, and named polyfetch (this repo's own e2e substrate,
  per .claude/rules/unattended-execution.md) explicitly instead of a generic "polyfetch-style"
  hedge.
• website-audit (1.2.2): verifying-design-canvas — added publishing comparison screenshots
  as a viewable page (embedded base64, captioned per specific claim) as an explicit technique for
  step 7 ("Report precisely"): a screenshot opened via the Read tool renders for the model only, so
  in a CLI session a human reader never sees it no matter how precisely it's described in text —
  confirmed on a real verification run this session.
• website-audit (1.2.1): verifying-design-canvas — folded in four lessons from a real
  design-fidelity run against a live canvas: get_file's 256 KiB cap truncates silently (always
  fetch .dc.html, never the compiled bundle); Cloudflare's bot challenge blocks headless
  claude.ai/design access even with a captured session cookie + solved cf_clearance, so
  DesignSync is the only working path; a committed mirror draws static-analysis noise that
  should be excluded at the repo's scan config, not hand-fixed in a file that gets wholesale
  replaced; a "recently refreshed" note is not proof of current freshness.
• website-audit (1.2.0): new verifying-design-canvas skill — pulls a Claude Design canvas
  straight from claude.ai/design via the DesignSync tool and verifies a live deployed app
  actually matches it (theme tokens, accessibility-tree structure, every interactive role/tab
  state), rather than trusting a text-only diff or a possibly-stale published Artifact snapshot.
  Also covers capability-backed canvases: stub window.claude for a structural-only check, or
  fall back to an authenticated live render when the capability's actual content needs verifying.

Changed

• typescript-dev (1.1.0, #182): defaults now type-checked ESLint (strictTypeChecked +
  stylisticTypeChecked + projectService), a complexity gate (cyclomatic ≤ 12, sonarjs
  cognitive ≤ 15), and exactOptionalPropertyTypes (with an interop caveat). Validated in
  agenthud-agui-a2ui #113/#115/#116. codebase-tools (hardening checklist): TS complexity row
  reconciled (was 20, cyclomatic only).
• #175 stability sweep: 13 mature skills now stability: stable + content-hash (guarded by
  verify-skill-hashes): commit-helper 1.1.2, docs-governance 1.6.1, ralph 1.0.4 (2),
  readme-generator 1.2.2, market-research 1.0.3 (8). 52 of 67 skills are now hash-guarded.
• workspace-setup (1.5.2): decided not to build ~/.claude.json rebuild-persistence — closed #203.
  Warning wording updated from "no recommended fix yet" to reflect that this is final, not pending.

Fixed

• web-recon (0.1.1): README "Requires" now matches web-recon-kit's current setup
  (make setup / make setup-browser); the separate polyfetch-scrape checkout is gone (missed in #194).
• security-audit (1.2.2): scanning-dependencies Python command is now
  uv run --with pip-audit pip-audit --skip-editable --format=json, matching the uv-first estate.
  Bare uvx pip-audit would audit only pip-audit's own tool env (28 pkgs vs the project's 68 in a
  test run) — a silent false negative.
• Makefile: recipes now fail fast (.SHELLFLAGS := -ec). Under .ONESHELL only the last line's
  exit code counted, so make validate passed with a broken plugin JSON and make check_sync
  passed with drifted copies or broken symlinks (subshell exit 1, bare diff -q).
• workspace-sandbox (#151): governance now ships README.md + CONTRIBUTING.md (mirrored from
  the docs-governance canon templates by make sync_governance, guarded by make check_sync), so the
  deployed AGENTS.md links resolve — parity with workspace-setup.
• marketplace (#184): removed the ghost simplify entry (plugin deleted in #119; claude plugin install simplify@… failed). gha-dev (1.2.3): companion-plugins reference now points at the
  built-in /simplify instead of the removed plugin.
• CI (#150): compute-skill-hashes.sh --check now fails on stable skills with no content-hash
  (15 of 39 bypassed the gate), and --update inserts a missing hash instead of silently doing
  nothing. Backfilled: cpp-desktop 1.0.2, gha-dev 1.2.2, go-dev 1.0.2, rust-dev 1.0.2,
  security-audit 1.2.1, typescript-dev 1.0.2.
• cc-meta (1.16.1, #155): the SessionStart seed no longer drops an untracked MEMORY.md into
  git working trees.
• workspace-setup (1.5.3), workspace-sandbox (1.3.12): read-once hook degrades to a no-op when
  jq/md5sum/realpath/stat is missing instead of failing every Read (#186); the 6 dead
  Bash(git:add:*)-style allow rules in the settings templates now use the matching
  Bash(git add:*) form (#183 — the ask commit / deny push rules are left for a policy decision).
• Pages deploy (#213): never succeeded since it was added (0/120 runs) — mkdocs.yml nav pointed
  outside docs/ and at 5 deleted analysis docs. Docs are now staged into docs/ at build time, the
  nav is generated, and the build uses uv. Stale counts dropped from site_description.
• README: badge 3.6.0 -> 3.7.0 (matches metadata.version); added the missing
  readme-generator and website-audit rows.
• cc-meta (1.15.3), docs-generator (1.0.4): quote multi-argument argument-hint
  values (e.g. "[time-range] [output-path]") in 7 SKILL.md files — unquoted [a] [b] is invalid
  YAML (expected <block end>, but found '['), so the frontmatter failed to parse.
• website-audit (1.2.4): quote the verifying-design-canvas description — the 1.2.3 trim
  introduced an unquoted colon followed by a space (.dc.html): theme), which YAML reads
  as a nested mapping.
• workspace-setup (1.5.1): link-claude-home.sh now verifies the symlink actually points at the
  configured persisted target, not just that some symlink exists at ~/.claude — a stale link (e.g.
  after a path or account change) previously read as "already linked" and was never corrected.

Added

• workspace-setup (1.5.0): scripts/link-claude-home.sh — copyable snippet that symlinks ~/.claude
  to persisted storage (e.g. /workspaces on GitHub Codespaces) so memory, sessions, settings, and
  credentials survive a container rebuild; must run from a devcontainer's onCreateCommand since a
  plugin hook can't bootstrap the directory it lives inside. SessionStart hook now warns (non-fatal)
  when it detects ~/.claude or ~/.claude.json isn't linked/persisted — the latter has no recommended
  fix yet, since symlinking an individual live-rewritten file is a known-risky pattern (#199 failure
  mode 1).
• security-audit (1.2.0): triaging-security-report skill — verify an external/AI-generated
  security report against the actual code before acting; four-way verdict rubric
  (CONFIRMED / OVERSTATED / FALSE-POSITIVE / FABRICATED), deployment-context severity re-rating,
  trusted-input precedents, salvage-the-kernels close-out (#188)

• market-research: New plugin with 8 skills — GTM pipeline with teams mode parallel dispatch, 2x2 strategy matrix, contradiction analysis, slide deck generation
• python-dev: Scaffold adapter for Ralph loop (scaffold/adapter.sh, project templates, GHA workflows)
• embedded-dev: Scaffold adapter with `find -print0 | xar...