chore(deps): update all dependencies - #44

v2.1.252

Compare Source

• Fixed Bash commands failing with "task output swap refused (tasks dir moved or linked)" on some Macs
• Fixed "always allow" not saving in a project that has no .claude/settings.local.json yet
• Fixed Remote Control sessions hosted by Claude Desktop or VS Code stalling for minutes after a tool finished when the connection to claude.ai was degraded
• Fixed background task notifications with very large failure output (for example git errors on a full disk) making the conversation exceed the API request size limit

v2.1.251

Compare Source

• Added PreModelSwitch and PostModelSwitch hook events (block, confirm, or annotate a model switch); SessionStart resume hooks now receive session staleness and the estimated re-cache cost
• Added live streaming of a foreground subagent's tool calls and results to Remote Control clients (background subagents, the default, still show status only)
• Added a Spend limit bar to /usage and a rate_limits.spend_limit status line field for developers behind a Claude apps gateway with spend limits
• Added a per-session prompt-cache line to /cost (hit ratio, misses, tokens re-cached, warm/cold) and a matching prompt_cache object for status line scripts
• Added attach, logs, stop, respawn, and rm to claude --help; the --resume message for a running background session now names the exact claude attach <id> command
• Fixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location
• Fixed plugin commands declared in a marketplace entry being able to point outside the plugin directory; such paths are now rejected with a path-traversal error
• Fixed project settings being able to enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint bypassing an OTLP collector pinned by managed settings or a host app
• Fixed the Workflow tool reading (and quoting in errors) a scriptPath outside what the session may read before the permission check ran
• Fixed Grep and Glob not applying Read(...) deny rules to files reached through a symlinked search path
• Fixed conversations getting stuck on "text content blocks must be non-empty" errors after a turn where the model produced only thinking
• Fixed the first launch on a fresh install starting in default mode instead of auto mode for accounts whose startup default is auto mode
• Fixed Opus 5 requests failing with "effort … is not supported when thinking is disabled" when effort was xhigh/max and thinking was turned off; effort is now sent as high in that case
• Fixed replying to a message Claude Desktop delivered from another session: SendMessage to that session id now delivers through Claude Desktop instead of failing with "not reachable"
• Fixed TUI lag with many parallel subagents: per-second progress ticks now replace their predecessor instead of piling up in the transcript
• Fixed agent teams: a teammate's final answer not reaching the team lead — it now arrives in the idle notification instead of a content-free "available" notice
• Fixed background subagents being unable to reply to a message from an unnamed sibling or parent agent (from was the agent type, which is not an address)
• Fixed managed-settings disableAutoMode arriving mid-session not moving an already-running auto-mode session back to default mode
• Fixed a "switch to Opus 1M for 5x more context" tip that appeared even when the current Opus model already has a 1M context window
• Fixed Claude apps gateway sessions treating a stored Anthropic profile (e.g. a Console sign-in) as active: listing it in /status and retrying gateway 401s with it, though requests never use it
• Fixed cloud sessions telling Claude the model had changed when the host was only setting the session's initial model
• Fixed Remote Control reporting a failure when an organization's policy disables it; it now shows a single quiet notice instead
• Fixed /mcp reconnect on Remote Control showing a generic withheld-detail error instead of the real remedy when a server was disabled in another session
• Fixed --input-format stream-json: client-injected assistant tool calls sent without a message id were merged into the first one and their results lost, including when resuming older sessions
• Fixed session transcripts being silently overwritten when a directory change relocated a session onto an existing same-ID transcript
• Fixed background sessions and their subagents being unable to edit files inside a git worktree they created with git worktree add
• Fixed background sessions occasionally starting without any plugin skills (and staying that way) when another Claude Code process was refreshing the plugin marketplace at the same moment
• Fixed selecting text in an opened background session inside tmux over SSH: it now copies to the tmux buffer like a foreground session instead of falling back to OSC 52
• Fixed SDK and cloud sessions hanging indefinitely when an SDK MCP server's handshake acknowledgment was lost; the wait now times out after 70 seconds and marks only that server failed
• Fixed self-hosted runner leaving a stuck session's Bash tool processes running after the session was force-stopped
• Fixed /usage-credits for Team and Enterprise members whose admin set the org's usage-credit limit to $0: it now offers to ask the admin instead of saying a cap was reached
• Fixed --worktree --tmux with a merge-request number on a gitlab.com origin trying a doomed GitHub-style fetch first instead of fetching the GitLab ref directly
• Fixed Ctrl+G failing with "Emacs quit unexpectedly" in background sessions for editors that open /dev/tty, such as emacs -nw and micro
• Fixed an additionalDirectories entry containing a null byte crashing startup, or breaking /add-dir and later settings updates when it came from an SDK host, IDE, or hook; it is now skipped
• Fixed the MCP server menu's copy shortcut: it now says how the sign-in URL was copied instead of always claiming success
• Fixed italic text (such as the session recap line) rendering as highlighted blocks in GNU screen and in tmux sessions using a screen terminal type
• Fixed claude mcp add --header and claude mcp add-json help text naming the wrong transports
• Fixed claude ultrareview and /ultrareview waiting the full 30 minutes when the cloud session fails to start; they now stop early and report the reason
• Fixed Bash permission checks auto-approving commands that assign an arithmetic expression to an integer shell variable (e.g. OPTIND=1/0, RANDOM=2+2); these now prompt for approval
• Fixed backgrounded sessions (←, /background, --bg) losing a Vertex/Bedrock gateway (ANTHROPIC_*_BASE_URL + CLAUDE_CODE_SKIP_*_AUTH) exported in the shell, so every request failed
• Fixed claude --bg --model fable on Max plans stopping to ask for usage credits while the interactive session on the same account still had Fable allowance
• Fixed the one-time "make auto mode your default" offer appearing in unattended sessions (e.g. agent-team teammate panes), where a stray keypress could accept it unread
• Fixed the managed-settings approval prompt re-appearing after signing in again to the same Claude apps gateway when the settings are unchanged
• Fixed disabled /bug and /share reporting that /feedback was disabled; tips, /help, and refusal messages no longer suggest /feedback when an org policy or env var turns it off
• Fixed cloud session creation advising GitHub setup after a transient GitHub connection failure — the message now says to retry instead
• Improved CPU usage during turns in interactive sessions by cutting redundant UI re-renders
• Improved install size: the native binary is about 5 MB smaller
• Improved cloud sessions: when the session's network proxy drops a connection during a Bash command, the tool result now names the host and reason instead of only "connection reset"
• Improved /schedule to explain that MCP servers configured in Claude Code can't be attached to cloud routines, instead of a bare "No MCP connectors" message
• Improved framing of messages from your own subagents: Claude is told the sender is a worker inside this session, not an unrelated Claude session
• Improved the prompt placeholder to read "Message @​name…" while viewing a background subagent or fork transcript opened from the subagent panel or /tasks
• Improved sanitization of MCP server names in error messages, menus, and command results
• Improved Amazon Bedrock session start under CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST (e.g. Claude Desktop): a session given a Bedrock model ID or ARN no longer waits for inference-profile discovery
• Improved the managed settings approval dialog to list only the settings that changed since you last approved them
• Improved retry when the model's tool call is malformed: the broken output is now dropped from the retry context, including on Bedrock, Vertex, and Foundry
• Changed /radio to be available on Bedrock, Vertex AI, Foundry, and Claude Platform on AWS, and when telemetry is disabled
• Changed Claude in Chrome so browser actions always go through Claude Code's permission checks, including in sessions with telemetry disabled, which previously used the Chrome extension's own prompts
• Changed CLAUDE_CODE_SUBAGENT_MODEL to set the default subagent model rather than override everything: an agent definition's model: and an explicit per-spawn model now take precedence over it
• Changed the default commit trailer to Co-Authored-By: Claude Code when the active model isn't a recognized Claude model (e.g. third-party models behind a custom ANTHROPIC_BASE_URL)
• Changed the default model for seat-based Enterprise subscriptions to Opus 5, matching other premium plans
• Changed /effort to save your default effort level per model, so each model keeps its own setting when you switch
• Changed analytics to no longer turn off before sign-in solely because managed settings force gateway login (or cannot be read); they stay off once signed in to the gateway or via DISABLE_TELEMETRY
• Changed the footer PR badge on Bedrock, Vertex, and Foundry, and when telemetry is off, to call the GitHub API directly (via gh auth token, GH_TOKEN, or GITHUB_TOKEN) instead of gh pr view
• Changed how Bash command output files are created and read back when commands run in the sandbox, so a sandboxed command cannot redirect or replace them
• Changed plugin/LSP install suggestions and the auto-mode default offer to wait until you've sent or cleared what you're typing, so the Enter that sends your prompt can't answer them
• Changed server-managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials, or weaken sandbox isolation to require approval before they apply
• Changed ANTHROPIC_CUSTOM_HEADERS from managed or project settings to require approval when it sets a credential, org/tenant, routing, or API-behavior header (e.g. Authorization, Host)
• Changed project-level .claude/settings.json env to no longer set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR/TMP/TEMP; set them in your shell, user, or managed settings instead
• Removed syntax highlighting for six rarely used languages (1c, gml, isbl, mathematica, maxima, sqf); the binary is 2.5 MB smaller
• [VSCode] Fixed the sign-in screen's "Bedrock, Foundry, or Vertex" button opening the docs at the top of the page instead of the third-party provider setup section
• [VSCode] Changed the Remote Control banner to a footer pill (shown while Remote Control is on or has failed) that opens the session on claude.ai/code; turn it on or off with /remote-control

v2.1.250

Compare Source

• Bug fixes and reliability improvements

v2.1.248

Compare Source

• Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files
• Added experimental.cacheTtl ("5m" or "1h") to agent frontmatter: a per-agent prompt cache TTL used when no subagent TTL setting is configured
• Added claude self-hosted-runner --client-label <label> (or SELF_HOSTED_RUNNER_CLIENT_LABEL) to override the label the runner registers with (default: hostname)
• Added server-managed settings diagnostics: a startup warning when the settings fail to load, and a /doctor and /status line explaining a load failure or why they weren't fetched (Bedrock/Vertex/third-party provider, custom ANTHROPIC_BASE_URL)
• Added a warning in /web-setup when the GitHub CLI token lacks the workflow scope, since pushes to very large repositories can be rejected without it
• Added /usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials, so members can request a higher usage limit from their admin
• Added cross-session messaging (SendMessage / ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabled
• Fixed a prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh
• Fixed the ScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, causing a full prompt-cache miss on the resumed session's first turn
• Fixed Claude Desktop and Cowork sessions disappearing after 30 days: the transcript cleanup now keeps desktop-written sessions while they are in the app (unless org policy manages retention); the new desktopSessionCleanupPeriodDays setting caps the exemption
• Fixed being sent to the login screen when another Claude Code process held the token refresh lock while the session token had expired; the request now fails with a retryable error instead
• Windows: Fixed the claude agents list not responding to the keyboard after detaching from a session, or when launched in a terminal tab left in win32-input-mode
• Fixed the recommended Console sign-in in /login failing with an OAuth error before showing a sign-in URL on machines where it can't be used (for example when ANTHROPIC_API_KEY or an API key helper is set); it now falls back to the API-key sign-in
• Fixed model names in /model and fast-mode switch notices to render as code, so suffixes like [1m] display literally instead of as a link
• Fixed claude agents skipping the workspace trust prompt when the CI environment variable is set
• Fixed claude agents crashing on launch when the PR-status cache held a malformed entry
• Fixed agent view resurrecting a weeks-old background session after the machine was off: such a session now shows as stopped at its real end, and opening it asks before resuming its saved conversation
• Fixed agent view sometimes opening an older conversation, and dropping the typed prompt, when starting a new session
• Fixed claude agents: opening a stopped session that you already resumed in another terminal no longer starts a second process on that conversation; the row now says it is open in a terminal
• Fixed claude agents and claude rm refusing to delete a session ("has commits that are not pushed anywhere") when its worktree branch was already merged into your checked-out default branch (e.g. local main) but not yet pushed
• Fixed background sessions waiting silently when a PermissionRequest or PreToolUse hook prints an invalid answer: the claude agents row now names the hook and the schema error
• Fixed hooks silently treating a stdout {…} object that isn't valid JSON as plain text; it's now reported as a hook error with the parse message
• Fixed /mcp listing a project .mcp.json entry that declares the claude.ai connector type under the trusted "claude.ai" heading; it now appears under its real scope
• Fixed MCP servers whose headersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the helper and retrying the call as documented
• Fixed /login to a Claude apps gateway hanging when the managed-settings security approval dialog was required
• Fixed gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY) never running when apiKeyHelper is the only credential
• Fixed claude logs leaving mouse tracking, bracketed paste and the alternate screen switched on in the terminal it was run from
• Fixed the trust dialog's list of repo permission rules showing a garbled character when a long rule was cut off in the middle of an emoji
• Fixed the permission mode indicator staying hidden behind the "Press Ctrl-C again to exit" hint when you press shift+tab right after ctrl+c
• Fixed /ultrareview and locally seeded cloud sessions uploading uncommitted edits to prod.env-style and *.tfvars files, or to editor swap, temp, and backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machine
• Fixed Remote Control sessions occasionally never showing a permission prompt or the latest messages on the connected device after the CLI silently reconnected
• Fixed cloud sessions occasionally failing at startup when the container's session credentials were not yet readable
• Fixed claude remote-control rejecting its own flags (e.g. --spawn, --name) when a global flag or a wrapper-injected option precedes the subcommand
• Fixed startup warnings (e.g. "N MCP servers need authentication") rendering one column right of the rest of the transcript
• Fixed a backgrounded worktree session losing its checkout: the background session now holds the worktree's lock while it runs, so cleanup and git worktree remove leave it alone
• Fixed @​-mentions of other sessions not matching names typed with non-Latin characters (for example Korean entered through an IME)
• Fixed an invalid crossSessionInbound value being silently ignored: it now warns and holds cross-session messages (user settings) or refuses them (managed settings) until fixed
• Fixed rate-limit, usage, and fast-mode messages telling you to run /usage-credits when that command isn't available for your organization (e.g. hidden with DISABLE_EXTRA_USAGE_COMMAND)
• [VSCode] Fixed a chat tab getting stuck on "No conversation found" when its session was never saved; it now starts a new conversation instead
• Improved the Workflow tool's prompt footprint: its description is now about 1k tokens instead of 5.7k, with the script-writing reference moved into a bundled workflow-authoring skill
• Improved the prompt-footer PR badge to check GitHub less often while the pull request is unchanged; a push or a gh pr command still refreshes it right away
• Improved managed settings: client-side timeout, MCP startup-mode, and stream-watchdog env vars no longer trigger the settings-approval prompt
• Improved /ultrareview <PR#> to check before launch that the GitHub account connected to your Claude account can access the repository, and to explain how to fix it, instead of failing after the cloud session starts
• Improved cross-session messaging: falls back to a private per-user /tmp directory when the default one can't be used, and the notice and /status name the directory to fix
• Changed shift+enter in the agent view dispatch input to insert a newline (matching the prompt); ctrl+enter now dispatches and attaches
• Changed /loop: self-paced dynamic mode and the no-prompt autonomous default are now always available, including on Bedrock/Vertex/Foundry
• Changed Anthropic telemetry export failures to log at debug level as [Anthropic telemetry] instead of [3P telemetry] OTEL diag error, so they are not mistaken for your OTel collector failing
• Changed cross-session messaging in Linux user namespaces: root-equivalent trust for unmapped owners is limited to canonical system directories
• Changed SendMessage from a subagent to another session: the result now notes that any reply is delivered to the parent session's conversation, not to the subagent

v3.14.0

Compare Source

This release drops support for Go 1.25 and includes many enhancements, particularly in the interpreter, which implements more shell features and fixes many divergences from Bash.

• cmd/shfmt
  • Add --detect to find shell files by executable bit or shebang - #​944
• syntax
  • Add Preorder, an iterator over all nodes, complementing Walk
  • Add encoding.TextUnmarshaler implementations for each operator type
  • Support ${ foo;} and ${|foo;} inside double quotes - #​1368
  • Support array elements in {varname} redirects, like exec {fds[3]}>&- - #​719
  • Backslashes inside backquotes within double quotes escape double quotes - #​1083
  • Allow pound signs in associative array keys like ${args[cmd,#]} - #​1285
  • Don't treat # as the start of a comment inside [[ ]] tests - #​1326
  • Don't join then or do with a semicolon when heredocs are pending - #​1047
  • Print a space after ! in arithmetic expressions, avoiding history expansion - #​987
  • Space nested closing parentheses like the opening ones - #​876
  • Make SplitBraces reject malformed sequences and skip backslash escapes - #​1330
  • Zsh: support the ${=name}, ${~name}, and ${^name} prefixes - #​1238
  • Zsh: support the ;| case terminator and leading parentheses for globs - #​1293, #​1279
  • Zsh: parse subscript flag arguments as patterns, and allow [ globs in arrays - #​1278, #​1322
• syntax/typedjson
  • Encode operators as their syntax form, such as ">>", rather than integers - #​1321
  • Return errors rather than panicking on malformed input
• interp
  • Add BashOpts to set Bash options like shopt - #​962
  • Add AccessHandler to control file access checks, used by -r and cd - #​1318
  • Add HandlerContext.LastExitStatus, and provide a HandlerContext to stat handlers
  • Implement the help and times builtins, as well as $- - #​1398
  • Implement the ;& and ;;& case terminators - #​1391
  • Implement the -N test operator, and make -nt and -ot follow POSIX - #​1340
  • Support sparse indexed arrays such as a=([5]=x) - #​1373
  • Run files as shell scripts when exec fails with ENOEXEC - #​1065
  • Support empty here-documents, and don't expand quoted ones - #​1390
  • Support js/wasm, where subprocesses and pipes are unavailable
  • Keep the redirections applied by exec with no arguments
  • Only fire the exit trap when the shell exits, rather than after every Run
• expand
  • Add BracesSeq with a config and error reporting, deprecating Braces
  • Add Variable.Indexes to describe sparse indexed arrays
  • Support integer bases in arithmetic - #​339
  • Short-circuit the arithmetic && and || operators - #​1371
  • Apply per-element operators to quoted array expansions like "${a[@]%o}" - #​1081
  • Make unquoted ${!arr[@]} consistent with the quoted form - #​672
  • Fix many divergences from Bash in arithmetic, string, and brace expansions
  • Reject unsupported Zsh syntax rather than panicking - #​1363
• pattern
  • Treat an unmatched [ as a literal character, like Bash - #​1372
  • Fix panics and mismatches in bracket expressions, such as [![:space:]]
• fileutil
  • Recognize dash shebangs as POSIX shell for -ln=auto - #​1307

Consider becoming a sponsor if you benefit from the work that went into this release!

Binaries built on go version go1.27.0 linux/amd64 with:

CGO_ENABLED=0 go build -trimpath -ldflags="-w -s"

v46.2.5

Compare Source

Documentation

• update references to renovatebot/github-action to v46.2.4 (c2ba0df)

Miscellaneous Chores

• deps: update node.js to v24.20.0 (8bff989)

Build System

• deps: lock file maintenance (40119c0)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.40.0 (7776f7b)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.43.1 (1a8a884)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.44.0 (94a8afa)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.45.2 (91a1ccd)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.45.3 (9df3426)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.45.4 (c0c2060)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.0 (246e8c4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.1 (a2cef85)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.2 (3ce659c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.4 (cd8ceb2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.5 (8f94c87)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.6 (7997c61)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.0 (a60af3a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.1 (508cd10)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.2 (cca913a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.3 (d450fc2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.49.0 (0afb379)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.49.1 (c409f02)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.50.1 (dbb0a9b)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.50.2 (f51cd98)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.50.3 (34b46a4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.51.0 (ea6c45c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.51.2 (9774ab2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.52.0 (e753d3e)
• deps: update ghcr.io/zizmorcore/zizmor docker tag to v1.30.0 (92becf5)
• deps: update zizmorcore/zizmor-action action to v0.6.3 (ea548b4)

v16.5.0: "Document Trust and Safer Automation"

Compare Source

[16.5.0] - 2026-08-31 - "Document Trust and Safer Automation"

Added ten reviewed skills for document trust, repository-backed slide decks,
serverless Redis, and distributed rate limiting; resolved the complete
exported security-findings batch. The published catalog contains 2,107
skills.

This release helps Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and
related AI coding assistants inspect documents with explicit human-review
boundaries, keep code-derived presentations tied to their source, and use
Upstash Redis and rate limiting without hiding production mutation or
fail-open behavior.

Start here:

• Install: npx agentic-awesome-skills
• verify-document and
  verify-citations for evidence-labeled document
  and source checks.
• slideops for cited HTML decks with later drift
  detection.
• upstash-redis and
  upstash-ratelimit for serverless data and
  traffic controls.
• Choose your tool
• Bundles

Added

• Added seven Stipple-backed document-trust skills for document forensics,
  citation verification, grounded extraction, Australian identity-pack gap
  checks, adverse-media review, AU/NZ tender matching, and AI-text triage. Each
  declares hosted-data transmission, consequential-decision, false-positive,
  and qualified-human-review boundaries
  (#​1305).
• Added slideops for repository-derived HTML decks whose
  code excerpts carry file, line, hash, and build-commit citations. The
  catalog copy pins upstream v1.0.0 and requires approval before installation,
  home-directory symlinks, optional downloads, or deck writes
  (#​1306).
• Added upstash-redis and
  upstash-ratelimit with explicit transaction,
  latency, algorithm, timeout, and edge-runtime limits; connected five
  existing queue, workflow, caching, and retry skills to the new routes
  (#​1307).
• Added a public FLOSS funding manifest with dated repository and npm evidence,
  a bounded sustainability plan, and a documented public/private boundary;
  then aligned its description with the live directory validator's
  500-character constraint
  (#​1299,
  #​1301).

Changed

• Expanded lovable-cleanup with Vercel favicon and
  CDN-cache recovery: overwrite-in-place semantics, complete icon linkage,
  cache-header guidance, and post-deployment verification
  (#​1296).
• Regenerated the canonical catalog, offline AAS Core data, tracked web assets,
  marketplaces, editorial bundles, compatibility reports, and Codex/Claude
  plugin distributions for 2,107 skills.

Fixed

• Replaced executable JavaScript parsing in Liuguang Banlan manifest helpers
  with a strict size-bounded parser, removed a mutable Agent QA npx fallback,
  and corrected mutation-risk metadata across Atlas, babysitting, and delegation
  skills
  (#​1303).
• Hardened pentest bootstrap instructions against mutable pipe-to-shell use;
  made Atlas temporary and final output handling symlink- and overwrite-aware;
  added a symlink-safe favicon writer; enforced Boost.Asio frame caps before
  allocation; rejected raw control characters before URL parsing; and pinned
  Unsloth model and dataset revisions with approval and provenance gates
  (#​1303).
• Removed a documentation-security false positive by describing atomic Upstash
  Lua scripting without presenting a dynamic evaluation call
  (#​1307).

Security and Reliability

• Classified all hosted document, identity, screening, database, rate-limit,
  and installer-backed workflows as critical where they transmit sensitive
  data, mutate remote state, deny traffic, install links, or write output.
• Required explicit approval and data minimization before third-party document
  uploads, and kept authenticity, misconduct, sanctions, tender, identity, and
  citation results as bounded review signals rather than final verdicts.
• Locked the exported security fixes with focused regression tests and kept
  generated catalogs and mirrors in the protected canonical-sync lane.

Who should care

• Compliance, finance, procurement, education, and operations teams that need
  document triage without turning probabilistic API output into an automatic
  consequential decision.
• Platform engineers using serverless Redis, distributed rate limits, queues,
  caching, or edge runtimes that need honest fail-open and mutation semantics.
• Engineering teams publishing code-derived decks that must show when cited
  snippets move or change.
• Maintainers who need security-export findings resolved in source and then
  propagated through protected canonical mirrors.

Validation

• Passed repository and reference validation, documentation-security checks,
  warning-budget enforcement, focused security regressions, the complete
  repository test suite, web-app coverage, npm audits, and protected canonical
  synchronization for the accepted source batch.
• Verified exact-head maintainer review and PR evidence for every changed
  canonical skill, with the redundant ai-code-reviewer proposal closed rather
  than adding a third overlapping AI-code audit workflow.
• Release publication additionally verifies clean final main, version and tag
  parity, npm metadata, CI, CodeQL, release-only Pages, live catalog and legacy
  bridge surfaces, and every already-configured local AAS MCP host.

Limitations

• The Stipple skills depend on a hosted third-party service; users must evaluate
  current retention, residency, deletion, legal, and organizational requirements
  before transmitting sensitive documents or personal data.
• Upstash behavior remains service-, plan-, region-, and SDK-version-dependent;
  examples do not replace production load, timeout, consistency, or failure-mode
  testing.
• SlideOps verifies cited snippets against repository state but cannot prove that
  uncited prose is correct or that a deck remains appropriate for its audience.
• Focused hardening reduces known failure paths but is not an independent audit of
  every bundled skill or upstream service.

Credits

• @​Sketchjar for the seven document-trust
  skills in
  #​1305.
• @​glukicov for slideops in
  #​1306.
• @​CahidArda for the Upstash Redis and rate
  limiting skills and routing updates in
  #​1307.
• @​WHOISABHISHEKADHIKARI for the
  Vercel favicon-cache recovery guidance in
  #​1296.

v16.4.0: "Sharper Reasoning and Safer Service Draining"

Compare Source

[16.4.0] - 2026-08-30 - "Sharper Reasoning and Safer Service Draining"

Refined falsification routing and graceful-shutdown guidance, retired a
discontinued UIZZE skill, and hardened canonical reference validation. The
published catalog contains 2,097 skills.

This release helps Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and
related AI coding assistants choose the right reasoning depth, drain production
services without fighting their process manager, and avoid stale catalog
references after a canonical skill is removed.

Start here:

• Install: npx agentic-awesome-skills
• falsify for explicit mode selection, calibrated
  falsification, and lightweight estimate routing.
• graceful-shutdown for bounded draining,
  readiness transitions, and shutdown deadlines.
• Choose your tool
• Bundles
• Workflows

Changed

• Updated falsify with a mandatory mode-selection gate so
  incidents, simple requests, rough estimates, questions, and deep analysis do
  not all enter the same heavyweight reasoning protocol
  (#​1287).
• Refined graceful-shutdown so liveness probes
  remain available during draining, aborted HTTP requests release their active
  counters, and FastAPI shutdown guidance preserves Uvicorn's signal ownership
  (#​1289).

Removed

• Removed the retired ui-slop-score skill after the canonical UIZZE project
  stopped publishing it; the maintained anti-ui-slop, ui-design, and
  ui-radar skills remain available
  (#​1288).

Fixed

• Reordered protected-main validation so canonical repository state is
  regenerated before cross-reference validation. Source-only skill deletions
  can now remove stale bundle and web references before the reference gate runs
  (#​1291).
• Regenerated the canonical catalog, offline AAS Core data, tracked web assets,
  marketplaces, editorial bundles, compatibility reports, and Codex/Claude
  plugin distributions for 2,097 skills
  (#​1292).

Security and Reliability

• Kept the updated skills documentation-only: they do not bundle or execute a
  server runtime, install dependencies, or take ownership of production
  signals.
• Preserved explicit shutdown deadlines and forced-exit fallbacks so draining
  cannot wait forever, while keeping readiness and liveness semantics separate.
• Bound canonical-reference checks to freshly regenerated trusted state and
  locked the workflow ordering with regression tests.

Who should care

• Engineers using agent reasoning protocols who need fast incident handling and
  direct, useful rough estimates without unnecessary ceremony.
• Platform teams operating Node.js, FastAPI, Kubernetes, workers, and long-lived
  connections that need predictable termination behavior.
• Maintainers removing retired skills from a source-only catalog without
  leaving stale generated references behind.

Validation

• Passed repository and reference validation, documentation-security checks,
  warning-budget enforcement, the complete 113-group repository test suite,
  176 web-app tests, the production web build, npm audits, plugin compatibility,
  bundle and marketplace checks, and protected canonical synchronization.
• Verified final source and canonical CI plus CodeQL on the exact protected
  main commit, with zero open pull requests, issues, security alerts, or
  generated-state drift before release preparation.

Limitations

• falsify structures routing and evidence checks but cannot guarantee truth or
  replace domain expertise and higher-quality evidence.
• Graceful shutdown remains runtime- and infrastructure-dependent; align probe,
  load-balancer, process-manager, and orchestrator deadlines in the deployed
  environment.
• Removing ui-slop-score does not remove the maintained UIZZE design-analysis
  skills or affect projects that independently pinned the retired upstream
  package.

Credits

• @​263311487-ux for the falsify
  routing update in
  #​1287.
• @​Prajeeth-12 for the revised
  graceful-shutdown guidance in
  #​1289.
• @​samuelbushi for identifying the
  retired UIZZE skill in
  #​1288.

v16.3.0: "Delegation Workflows and Reliable Operations"

Compare Source

[16.3.0] - 2026-08-28 - "Delegation Workflows and Reliable Operations"

Added 24 reviewed skills for multi-agent delegation, pull-request review,
scientific reasoning, model fine-tuning, MCP operation, and graceful service
shutdown. The published catalog contains 2,098 skills.

This release helps Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and
related AI coding assistants delegate bounded implementation work, review and
monitor pull requests, challenge scientific claims, fine-tune models on limited
hardware, operate SandBase safely, and shut down production services without
dropping in-flight work.

Start here:

• Install: npx agentic-awesome-skills
• delegate-setup for configuring the external
  delegation runtime before selecting an implementer relay.
• babysit-pr and
  debate-review for iterative review and
  two-perspective code-review workflows.
• graceful-shutdown for bounded draining,
  readiness transitions, and shutdown deadlines.
• Choose your tool
• Bundles

Added

• Added delegate-setup and 17 docs-only implementer
  relays for Agy, Aider, Claude, Cline, Codex, CommandCode, Copilot, Cursor,
  Grok, Kimi, OMP, OpenCode, Pi, Qoder, Vibe, Warp, and ZCode. Each relay ships
  its complete dispatch, queue, review, and brief-writing references while
  keeping review and landing with the orchestrator
  (#​1283).
• Added babysit-pr for bounded review-round monitoring
  and debate-review for structured two-model review,
  including their prompt, schema, and comment-format assets
  (#​1282).
• Added falsify for explicit hypotheses, adversarial
  checks, evidence grading, calibrated conclusions, and a durable thinking
  ledger (#​1281).
• Added sandbase-mcp with immutable release pinning,
  checksum and archive verification, and explicit credential, privacy, cost,
  and mutation approval gates
  (#​1279).
• Added unsloth-finetuning for single-GPU VRAM
  planning, LoRA and QLoRA, GRPO and DPO, template and loss-mask correctness,
  and GGUF or merged-model export
  (#​1278).
• Added graceful-shutdown for SIGTERM and SIGINT
  handling, connection draining, probe transitions, shutdown deadlines, and
  Kubernetes-aware Node.js, Python, and worker patterns
  (#​1276).

Changed

• Upgraded the catalog web app from @supabase/supabase-js 2.112.0 to 2.112.2,
  including fixes for duplicate Realtime bindings, stale sign-out payloads,
  preserved authentication 5xx messages, and token refresh behavior
  (#​1273).
• Regenerated the canonical catalog, offline AAS Core data, tracked web assets,
  marketplaces, editorial bundles, compatibility reports, and Codex/Claude
  plugin distributions for 2,098 skills.

Fixed

• Removed retired UIZZE score-endpoint guidance while keeping the skill's
  source-only scoring workflow intact
  (#​1274).
• Restored every companion reference, prompt, schema, and template required by
  the imported review, delegation, and scientific-reasoning skills instead of
  publishing incomplete entrypoints.
• Replaced 18 truncated delegation descriptions with complete trigger and
  operating-boundary summaries.

Security

• Kept the delegation and review integrations docs-only: their external
  runtimes are not bundled, relays never land changes, and unsandboxed,
  all-tools, or danger-full-access execution requires separate human
  authorization.
• Pinned SandBase to the reviewed v0.1.17 release and SHA-256
  1ad535b2899ca460b57b3c268aef278fee28fd28e649a89b92951514fd71fffa,
  with archive inspection before installation and two approval boundaries
  before credentialed or mutating work.
• Kept Unsloth training and export guidance bounded by hardware checks,
  explicit dataset and template validation, checkpointing, and output review.
• Kept graceful shutdown bounded by deadlines and forced-exit fallbacks so
  draining cannot hang a deployment indefinitely.

Who should care

• Teams orchestrating multiple coding agents that need explicit task briefs,
  bounded permissions, polling, independent review, and controlled landing.
• Maintainers who need repeatable pull-request review rounds without confusing
  an external runtime with bundled repository functionality.
• Researchers and ML practitioners who need falsification discipline or
  practical single-GPU fine-tuning guidance.
• Platform engineers operating MCP services, Kubernetes workloads, workers,
  and long-lived production connections.

Validation

• Passed repository and reference validation, documentation-security checks,
  warning-budget enforcement, the complete 113-group repository test suite,
  176 web-app tests, the production web build, npm audits, plugin compatibility,
  bundle and marketplace checks, and protected canonical synchronization.
• Reviewed every changed canonical skill subtree and bundled asset for
  semantics, safety, provenance, declared risk, limitations, permission
  escalation, and review or landing boundaries before protected merge.
• Verified final source and canonical CI plus CodeQL on the exact protected
  main commit with no open pull requests, issues, or generated-state drift.

Limitations

• The delegation and review skills document external runtimes; installing AAS
  alone does not install or authenticate those tools.
• Delegation can distribute implementation work, but it does not replace
  orchestrator review, test evidence, repository policy, or human approval for
  elevated execution.
• Falsification structures reasoning but cannot guarantee scientific truth or
  replace domain expertise, replication, or higher-quality evidence.
• Unsloth memory estimates and export paths remain model-, dataset-, hardware-,
  and version-dependent; validate against the current upstream project.
• SandBase operations may incur external service costs and expose supplied
  data to its service; review current upstream terms and privacy behavior.

Credits

• @​FrancoStino and the MIT-licensed
  amElnagdy/delegate-skills
  and amElnagdy/review-skills
  sources for the delegation and review collections proposed in
  #​1265 and
  #​1264.
• @​263311487-ux for falsify, proposed
  in #​1266.
• @​A-ryanVAT-S for
  unsloth-finetuning, proposed in
  #​1267.
• @​denial123789 for sandbase-mcp,
  proposed in #​1269.
• @​Prajeeth-12 for
  graceful-shutdown, proposed in
  #​1272.
• @​samuelbushi for the UIZZE documentation
  correction proposed in
  #​1271.
• Snyk for the Supabase dependency update in
  #​1273.