luna-prompts · latentloop07 · Jun 15, 2026 · May 24, 2026 · Jun 9, 2026 · Jun 15, 2026
diff --git a/.gitignore b/.gitignore
@@ -75,3 +75,8 @@ test-results/
 # SkillNote per-project state (per-machine; pins active collection)
 .skillnote.json
 .skillnote/
+
+# Personal scratch (marketing posts, draft tweets, release-notes outlines)
+skillnote-release-posts.md
+x-replies-paste.md
+extensions/claude-ai/scripts/captured-endpoints.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,67 @@
 All notable changes to SkillNote will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.6.0] - 2026-06-15
+
+**The claude.ai connector.** SkillNote now syncs your collections to your
+claude.ai account and pulls claude.ai-authored skills back — no copy-paste
+either way. A self-hosted browser extension reads your existing claude.ai
+session locally and talks only to claude.ai and your own SkillNote URL; the
+SkillNote project never sees your data.
+
+Minor version bump (not a patch): this adds a new distribution surface, new
+backend endpoints, eight database migrations, and a browser extension. No
+breaking changes to existing skill/collection/version APIs.
+
+### Added
+
+- **claude.ai browser extension** (`extensions/claude-ai/`, versioned `0.1.0`
+  for the Chrome Web Store / Firefox AMO). Opens as a **side panel** beside
+  claude.ai, pairs in-panel (6-char code approved via the SkillNote
+  notifications bell — no separate tab), and matches claude.ai's light/dark
+  appearance in real time. Surfaces how often your skills get used and which
+  collections are live. 153 unit tests.
+- **Per-collection publishing to claude.ai.** A collection's **Sync** menu
+  toggles it on; it appears in claude.ai's **Customize → Plugins** as the
+  plugin group `SkillNote: <collection>` and re-syncs on every change. You
+  choose what leaves SkillNote per-collection; dev-only or sensitive
+  collections simply stay off. Backed by `published_to_claude_ai` on
+  collections.
+- **Per-skill sync toggle** (`Syncing to claude.ai` badge) and **conflict
+  resolution** (keep-SkillNote / keep-claude.ai / skip) when the same skill
+  diverges on both sides.
+- **Notifications** (renamed from Activity). A unified feed of connector and
+  skill-lifecycle events (create / edit / delete / restore), kept for 3 days,
+  reachable from the sidebar, the top-right bell, and the extension panel.
+- **Backend sync engine**: pairing handshake, an idempotent sync queue with
+  coalescing, a stalled-op reaper, conflict detection, an audit log, a
+  `POST /v1/claude-ai/extension/reconcile` recovery endpoint, and
+  filtering/pagination on `GET /v1/collections` (`q`, `published`, `limit` +
+  `X-Total-Count`).
+- **Validation hardening**: Windows-reserved skill names (`con`, `nul`,
+  `com1`…) are rejected, and namespaced skill names (`owner:skill`) are
+  accepted — mirrored frontend and backend.
+- **Migrations 0021–0028** (cookie-expired audit, sync-op indexes/columns,
+  collection publish flag, staged version links, session names, skill-event
+  audit constraint). Single linear head.
+
+### Security
+
+- **Cleared all 20 open Dependabot alerts** across the web app, CLI, and
+  extension (2 critical, several high). `hono` → 4.12.25, `esbuild` → 0.28.1,
+  `undici` → ^6.26.0, `uuid` → ^11.1.1, `postcss` → 8.5.15 (pinned via npm
+  `overrides`); `vitest` → ^3.2.6 and `vite` → ^6.4.3 (dev tooling). No
+  runtime API changes; all builds and the full test suites (CLI 143,
+  extension 153) stay green. `tsup`/`dockerode`/`testcontainers` were flagged
+  only for bundling a vulnerable `esbuild`/`undici` and are fixed by the
+  overrides without major-bumping them.
+
+### Notes
+
+- The extension is not yet on the Chrome Web Store (listing pending review);
+  load it unpacked from `extensions/claude-ai/dist` for now. See
+  `docs/claude-ai-user-guide.md` and `extensions/claude-ai/STORE_LISTING.md`.
+
 ## [0.5.5] - 2026-05-26
 
 Visibility fix for bundled skills (closes #57). Skills imported from a marketplace, plugin, or `skill_bundle` import source were indistinguishable from locally-authored skills in the grid/list views — the only origin surface was the right-rail `SourceCard` on the detail page, which required clicking into a skill to see. ozp reported that with many bundled skills loaded, the library became hard to scan. This release adds a single small `BundlePill` component used consistently in three places so bundled-vs-local is identifiable at a glance.

diff --git a/Dockerfile b/Dockerfile
@@ -15,6 +15,11 @@ COPY . .
 ENV NEXT_TELEMETRY_DISABLED=1
 ARG NEXT_PUBLIC_API_BASE_URL=http://localhost:8082
 ENV NEXT_PUBLIC_API_BASE_URL=$NEXT_PUBLIC_API_BASE_URL
+# Server-side target for the /v1 proxy rewrite in next.config.ts. Baked at
+# build time because Next.js evaluates rewrites() during `next build`. In
+# Docker the web server reaches the API over the internal network (api:8080).
+ARG SKILLNOTE_API_PROXY_TARGET=http://localhost:8082
+ENV SKILLNOTE_API_PROXY_TARGET=$SKILLNOTE_API_PROXY_TARGET
 RUN npm run build
 
 # Production image

diff --git a/README.md b/README.md
@@ -33,7 +33,7 @@
 <br />
 
 <p align="center">
-  <img src="docs/screenshots/connect-browse-r9.png" width="100%" alt="SkillNote Connect page browsing Claude Code and OpenClaw as official agent integrations, each shown with its canonical mark" />
+  <img src="docs/screenshots/connect-browse.png" width="100%" alt="SkillNote Connect page browsing Claude Code, OpenClaw, and claude.ai as official agent integrations, each shown with its canonical mark" />
 </p>
 
 ---
@@ -196,6 +196,38 @@ npx skillnote connect openclaw
 
 </details>
 
+### claude.ai (web app)
+
+A small Chrome extension syncs your SkillNote collections to your claude.ai account as plugin groups — skills you publish in SkillNote appear in claude.ai's **Customize → Plugins**, and claude.ai-authored skills import back. No copy-paste either way. The extension opens as a **side panel** beside claude.ai, matches its light/dark theme, and shows how often your skills actually get used.
+
+<div align="center">
+  <img src="docs/screenshots/claude-ai-connector.png" width="360" alt="SkillNote claude.ai connector side panel: Connected status, a 'This week on claude.ai' usage card (42 skill uses, most used code-review-checklist), and the collections currently live on claude.ai" />
+</div>
+
+**Install** (Chrome Web Store listing pending review — load unpacked for now):
+
+```bash
+cd extensions/claude-ai && npm install && npm run build
+# chrome://extensions → enable Developer mode → Load unpacked → select dist/
+```
+
+**Connect** — everything happens in the panel, no separate tab:
+
+1. Click the SkillNote toolbar icon to open the side panel.
+2. Enter your SkillNote URL — the same address you open in your browser (e.g. `http://localhost:3000`) — and click **Connect**. (Chrome asks once for permission to reach that address.)
+3. In SkillNote, the **notifications bell** (top-right) shows the pairing request — confirm the code matches and click **Approve**.
+4. Choose what to sync: on any collection in SkillNote, open **Sync ▾ → claude.ai** and flip the toggle. Those skills appear in claude.ai within seconds (as the plugin group `SkillNote: <collection>`), and re-sync automatically on every change.
+
+<div align="center">
+  <img src="docs/screenshots/collection-sync-claude-ai.png" width="100%" alt="A SkillNote collection's Sync menu open, showing the claude.ai connector toggled on — the collection is live on claude.ai as the plugin group 'SkillNote: conventions', with OpenAI listed as coming soon" />
+</div>
+
+You stay in control of what leaves SkillNote: the **Sync** menu is per-collection, so dev-only or sensitive collections simply stay off. Toggle one on and it's live on claude.ai; toggle it off and the connector retires that plugin group.
+
+Sync runs automatically while you're signed in to claude.ai. The extension reads your claude.ai session cookies **locally only** — they never leave your machine, and it only ever talks to claude.ai and the SkillNote URL you entered.
+
+Full walkthrough: [`docs/claude-ai-user-guide.md`](docs/claude-ai-user-guide.md) · architecture: [`docs/claude-ai-integration.md`](docs/claude-ai-integration.md) · admin runbook: [`docs/claude-ai-admin-runbook.md`](docs/claude-ai-admin-runbook.md) · privacy: [`extensions/claude-ai/PRIVACY.md`](extensions/claude-ai/PRIVACY.md).
+
 > Cursor, Codex, Antigravity, and OpenHands are on the roadmap. [Open an issue](https://github.com/luna-prompts/skillnote/issues) if you want to help build an adapter.
 
 ---

diff --git a/RELEASE-NOTES-0.5.3.md b/RELEASE-NOTES-0.5.3.md
@@ -0,0 +1,84 @@
+# SkillNote 0.5.3
+
+A polish and positioning release. Nothing dramatic on the API side, no new commands, no breaking changes, but every part of the front door got a careful pass. The sidebar information architecture is cleaner, the README leads with the problem Claude Code users actually feel, and the install paths now include Homebrew alongside npm.
+
+## Homebrew is in
+
+You can now install SkillNote with Homebrew on macOS or Linux:
+
+```bash
+brew install luna-prompts/tap/skillnote
+skillnote start
+```
+
+The formula pulls the same `skillnote` package from npm but lets `brew` manage the binary. Node 20+ comes in as a Homebrew dependency, so you don't need a pre-existing Node install.
+
+Other install paths are unchanged: `npx skillnote start`, raw Docker Compose, or `clawhub install skillnote` for the OpenClaw side.
+
+## The sidebar got fixed
+
+Two complaints we'd been hearing:
+
+- Analytics felt buried under Connect, when it's really a view of your skill data, not part of the agent setup flow.
+- The Connect group label was repeating its only item ("CONNECT > Connect").
+
+Both are fixed. The sidebar is now:
+
+```
+WORKSPACE                INTEGRATIONS
+  Skills                   Connect
+  Collections
+  Analytics
+  Marketplace
+```
+
+Analytics and Marketplace live with the rest of your skill-management surface. The agent wire-up page sits in its own clearly-named INTEGRATIONS group. No more orphan items between the two sections.
+
+## The README leads with the problem
+
+The README has been fully rewritten. It now opens with the **8,000-character Claude Code skill truncation** issue (the pain new SkillNote users actually feel) instead of a feature tour. Down from 659 to ~495 lines.
+
+Two new pieces worth pointing out:
+
+1. **Five community skill registries are linked one click away.** `anthropics/skills`, `ComposioHQ/awesome-claude-skills` (800+ skills), `alirezarezvani/claude-skills` (600+), `garrytan/gstack` (50+), `obra/superpowers`. New installs aren't staring at an empty Skills page anymore. They have a clear next step.
+
+2. **Four LLM-search-friendly FAQ entries** sit at the top of the FAQ: *"What is SkillNote?"*, *"How is SkillNote different from MCP?"*, *"How do I share Claude Code skills across my team?"*, *"Is SkillNote free?"*. Phrased the way people actually ask ChatGPT or Claude about a project, so SkillNote is more likely to surface when someone asks an AI assistant for help.
+
+## PWA dock icon is finally black
+
+If you'd installed SkillNote as a PWA on macOS or Android, you were seeing a teal frame around the black LP logo. That was a bug in the maskable icon PNG, not the manifest theme color (the manifest was already correct after 0.5.2). Fixed in 0.5.3.
+
+**Existing PWA users:** browsers cache the dock icon. To pick up the new all-black icon, uninstall the SkillNote PWA from your dock or home screen, then reinstall it via Chrome's address bar ("Install SkillNote") or `⋮ → Cast/Save/Share → Install SkillNote`.
+
+## Upgrading
+
+If you're on the npm path:
+
+```bash
+npx skillnote restart
+```
+
+That pulls the new images. No data migration. No config changes. The Postgres volume is preserved across the restart.
+
+If you're on the raw Docker Compose path:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/luna-prompts/skillnote/cli-v0.5.3/deploy/docker-compose.yml -o docker-compose.yml
+docker compose up -d
+```
+
+The OpenClaw skill bundle gets updated automatically on the next `sync.sh` run, which happens every 60 seconds and on each Claude session start.
+
+## What's next
+
+A few items already in motion for the next minor release:
+
+- **Phase 2C deprecation** of the legacy v0.4 file-push commands (`login`, `add`, `update`, `remove`, `check`, `doctor`) in favor of the lifecycle CLI. Tracked in issue [#40](https://github.com/luna-prompts/skillnote/issues/40).
+- **API authentication** for non-localhost deployments. Currently the API is open to anything that can reach `:8082`. The roadmap is a pluggable auth layer so SkillNote is safe behind a reverse proxy without bolt-on hacks.
+- **Cursor and Codex CLI native plugins.** OpenHands and Antigravity are further out. Open an issue if you'd like to help with any of them.
+
+---
+
+**Links:** Full changelog in [`CHANGELOG.md`](CHANGELOG.md) · GitHub Release [`cli-v0.5.3`](https://github.com/luna-prompts/skillnote/releases/tag/cli-v0.5.3) · npm: `skillnote@0.5.3` · Docker: `ghcr.io/luna-prompts/skillnote-{api,web}:0.5.3` · clawhub: `skillnote@0.5.3`
+
+**Help wanted:** join us on [Discord](https://discord.gg/GazU4amU6H) or [open an issue](https://github.com/luna-prompts/skillnote/issues).