Task titles, notes, subtask text, and section names from the opened task
file, plus memory file and directory names, were interpolated into
innerHTML template strings unescaped, so markup in that content was parsed
as HTML when the dashboard rendered.
- Route every such interpolation through the existing escapeHtml() helper.
- Make escapeHtml() also escape quotes so it is safe inside attribute
values (data-tab, data-search, placeholder).
- Replace the inline onclick/oninput handlers that embedded file and
directory names in JavaScript string literals with addEventListener,
matching the pattern the rest of the file already uses.
- Bump plugin version to 1.3.1.
The ms365 / microsoft-365 entries ship M365 as a manual type:http MCP
server. That auth path cannot succeed: the M365 server's OAuth client
registration only permits the claude.ai callback, so any client-initiated
OAuth flow (localhost or claude:// redirect) is rejected by the identity
provider before the consent screen ever shows (AADSTS50011).
Users connect Microsoft 365 through the claude.ai Connectors directory
instead, which uses the registered callback and works. Plugin skills
reference tools via ~~category placeholders (see CONNECTORS.md), not the
ms365 server key, so no content changes are needed.
Bumps each touched plugin's version so the update distributes to
existing installs.
Co-authored-by: Claude <noreply@anthropic.com>
Slack's auth server does not support dynamic client registration, so a
bare {type, url} config fails in Claude Code with "Incompatible auth
server: does not support DCR" before the OAuth prompt appears.
Cowork/Desktop resolve these via the claude.ai connector directory and
don't hit this, but Claude Code does raw OAuth against the URL. The
broken entry also shadows the working claude.ai Slack passthrough
(manual > plugin > claude.ai dedup), so users lose Slack entirely.
Adds the same oauth.{clientId, callbackPort} block already present in
partner-built/slack/.mcp.json to all 12 role plugins.
Refs: anthropics/claude-code#38229
Across all plugin .mcp.json files:
- Rename "google-calendar" key to "google calendar"
- Replace gmail and google calendar URLs with empty string placeholders
- Convert all commands/*.md files to skills/*/SKILL.md format
- Merge 36 reference-skill pairs into their invokable counterparts
- Mark reference-only skills as user-invocable: false
- Expand descriptions for migrated skills with usage scenarios
- Keep partner-built/ commands as-is
- Remove bio-research from marketplace.json
Jake Marsh