From fd6abd6d4133aeb2630eae413e33922ccc1e0d20 Mon Sep 17 00:00:00 2001 From: Eddie A Tejeda <669988+eddietejeda@users.noreply.github.com> Date: Sun, 18 Oct 2026 11:40:16 -0700 Subject: [PATCH 1/2] docs(plugin): auto-update note and disclosure for the plugin directory - README: how to turn on auto-update for the self-hosted hotdata marketplace, which is off by default. - README: what the plugin runs, sends, and fetches. Anthropic's directory scan rejects behavior the README doesn't disclose, so this lists the SessionStart hook, the installer it offers, the Hotdata API the skill's commands use, the browser login, and the GitHub release check. - plugin.json: displayName "Hotdata CLI" for the directory listing. --- .claude-plugin/plugin.json | 1 + README.md | 30 ++++++++++++++++++++++++++---- 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 38bfdc4..f4ce687 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,5 +1,6 @@ { "name": "hotdata-cli", + "displayName": "Hotdata CLI", "description": "Teach Claude the Hotdata CLI: workspaces, databases, SQL, ingest, search, analytics, and geospatial", "version": "0.44.0", "author": { diff --git a/README.md b/README.md index 4bd4b42..3998678 100644 --- a/README.md +++ b/README.md @@ -44,10 +44,32 @@ updates it with each release: /plugin install hotdata-cli@hotdata ``` -The plugin checks for the CLI when a session starts and offers to install it if -it's missing. Use either the plugin or the installer's skill, not both: if you -installed the CLI with the script above, install it with `HOTDATA_NO_SKILLS=1` -or Claude Code will list the skill twice. +Self-hosted marketplaces don't auto-update by default. To get each release +automatically, open `/plugin`, go to **Marketplaces**, select `hotdata`, and +choose **Enable auto-update**. Otherwise run `/plugin marketplace update hotdata` +when a new version ships. + +Use either the plugin or the installer's skill, not both: if you installed the +CLI with the script above, install it with `HOTDATA_NO_SKILLS=1` or Claude Code +will list the skill twice. + +What the plugin runs, sends, and fetches: + +- **SessionStart hook** (`hooks/check-cli.sh`, Claude Code and Cowork only): + checks whether `hotdata` is on `PATH` or in `~/.hotdata/cli`. If it's only in + `~/.hotdata/cli`, it adds that folder to `PATH` for the session. If it's + missing, it asks Claude to offer the installer. The hook makes no network + requests, installs nothing, and sends no data. +- **Installer**, only after you agree: `curl -fsSL https://hotdata.dev/install | + HOTDATA_NO_SKILLS=1 sh` downloads the CLI from this repository's GitHub + releases, or installs it with Homebrew if `brew` is present. +- **The skill** teaches Claude to run `hotdata` commands. Those commands talk to + the Hotdata API (`https://api.hotdata.dev/v1`, or `HOTDATA_API_URL`) with your + Hotdata credentials, and send the queries, files, and data source settings + you ask Claude to work with. `hotdata auth login` opens + `https://app.hotdata.dev` in your browser, and the CLI checks this + repository's GitHub releases for new versions (`HOTDATA_NO_UPDATE_CHECK=1` + turns that off). Neither the plugin nor the CLI collects telemetry. ## Quickstart From 2a779f4996f1eb3ed7835a3c739a575af9e7f17f Mon Sep 17 00:00:00 2001 From: Eddie A Tejeda <669988+eddietejeda@users.noreply.github.com> Date: Sun, 18 Oct 2026 14:15:10 -0700 Subject: [PATCH 2/2] feat(plugin): listing icon for the plugin directory The directory reads the icon once, when the plugin is first saved or submitted, so it has to be in place before the submission. Same 552x552 mark as hotdata.dev's favicon. --- .claude-plugin/icon.png | Bin 0 -> 11381 bytes .claude-plugin/plugin.json | 3 ++- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .claude-plugin/icon.png diff --git a/.claude-plugin/icon.png b/.claude-plugin/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..c19fd97b1339150ac7bd8f2a2a0ccd1d5b81c170 GIT binary patch literal 11381 zcmeHt`9IYC*FR&_45w~*2hy_y_%qlklU`xji!k@NpGYg z1)qzmxE9C>KHNCsB7aA?i0561Qb9*tx`}z}RgI%Xo}XW^{F^Mw9#|CBrdT=Z{ABIW z3`lG6blG&Xr!Tc^UWO3J#f?CsnCtU3YvfjKS^nr})@^iO!@a-St-m_0@6a)zz(^AU z%by}1?kLkZS?V{_rs|5r<*m)@@|=Bo{fa1?2T(9jdlz51l`y8)n;yQ1(?eQ0l}xVRe;Tv$WgPCntH>pJFov=W1~cT9H0NN#dNMimh9ZZ>y@Lc@ zqEL|Tl1N-s83scby)2=0c;GeKR=(?OVS f-YV#eVN53ZeFah@QR9|f!8QkrR5&2K@Ag-*zaIM=ihpzL|5ov!s`jl* zA4Yxgo2aQMaJLQi+B?}jR;lja<;LppS{FS!lM`Rw_u*l1QrTQzPsZXO_lnW^&QY79 z5tfP9dMKs@db#njjXvHlTAcGb_I>gHoo92I|BLTvNyXyAaM$KimTy_oNVweN1+(}+ zlVc0({M@dL6buL&pBIMqkS#wp$6vc{$I1DUnFNL!eKav1UVb5EiNfnYNbQcC*yA=C$M8|1C?_Zk< zejI*6+!q1g+YRkNHvW1|S=!fT6$GhDbjEez=$WzyLS)K=7gKTwv9OMaG)5RPke~p~^yucB_D2as`&}nyWeBIXbMv0xe&VN~ z25^qy8pnc6o*=rGTk(Er3j#4jBuA1Pk;aF^rEPVzv4_L5KZ%BMQTGGur^;dVcLQnl zrcIut!1B`wzN*tMod>$@xUqe9di)say3D|9^=|pO4?wr~@%Pba%y9#P?uoY@X6Ta} z$&_@nX&yK&ogas5#?Mj9eL!xXsW_uRf(b}zyFKv-nLr#=_ORSaIF$;Pi>%~FK7j8% zP-pE&ATNPPn(jM~zD1BoZ+qJJa3h+*B0q%}2+|-EO`bmjBb|8%zILZ5Nl2=0*ggak$_D?~T+qVD2}`+PD6roZhMEKw6e@B@2zQJ4(=H z8_dB347Z&k4u%T`-aKy)A+yjpe5>Hjb=(Md;N117ST>}9W_Sb@W!w0 zgpjBh44G^aI87sjgV^CIQBhn}D=_zViH!Bhh6G{?Zrd|KX=MclBTTS>O3(%(?GsUS zE@}r5xkzOQCWF{1+f{gkq}>2OUE&LMU7u_PkF<3sgrpga=`|R;BcPbt@phTI5O5l? zF1IxaJZn4RY0TgSTooidOf6r_jXl5m&O;Q&5OiRMSDr%lg2^-vDXy2!3*H0E-b}^KxTpCPekn8NDTs#Acpo$E-De! zl-sT@WM>9Ss2(elA-@2a=zZ9KDbZV0Z_^_hCqL44Gn1U>W{5Ub(0d;AY}_ z8zJdTI%rSN9>64n6;sqS&I%=i9w~bXUxkkAfj#tERZ*Dy!vx)e!xiypOp5}8>69=I zl}HsVqROzK5mLcrsqfo1QvE=vQX`}N(m4>sdn7B?+W~5}-%1kSk{JWR7?UHv{yW6t z;4bgkt!~Uf+9f$g9tdDY&~1JH^#J59n6}8H_+Vi9PB6+&pUy*pn-T@_Ph5EZiE&Db?jbi zx&P)1YBTWO>}to0&<0OxC%V)kMW7yvtYT>(1mJrDH|+S?cBd@a{TDp(&QeBG`+-rv zY_2W>>I_M=uaLiFvi{J|wcUfrDUf68#wBs;M{x1MeO$GBCyZpZo`*|9d`MDq4G?c3 zFW=52c(Vrfu@>vA&tMRkjI}r*F-q{zcYz#W~M^26C zEKZb(?wfrrWIv!PN_7T@?-uKluY*EfPhJ@H?b@++nV?k`G z`W-2~icR>%6>hpL<3o_qn&#pjPa;JZv~A$#ePi4GIFQzR9TJ+hl+bSMo?dw9Vb@Vg zVOU9&u_C@^zr8HGqTu$SG9YTKU-sOt0?$_=RJSji$Qn%KV_X`3RT1y}&2A%7SU8?) z2H|9O!tcdOYg`t91p;*Ha9P8M{RknuQpJ}(@+}nqJ zG1S8lvGjKWY=fqp8L5?HFwc=HwsCrx&R1Y9c2P;YD3GS2^?WsESq`^ks9ec0tn=V7 z73Qg%957>ZYLrxkcqh3N+OCRtS`a!63dFPhE*jY%?T!QzL6=nc5AgueC^S z0I_dGSlla5hWbYOb`!^q#ggjxI6{g$Ci`Bfg^Z{j%*gb@p6B(ry9R*WE1c4Q{E`i& zU&)~a3&LY_v{N~bIrgQ9mL*eaAf*I_%Gi#3#nkL(6092HITy|CERxPxt$fF7c&!dE=A4Fub!G~#_9Ji|=P@ev`DeN1%5!Pc*PM4h1r zLCEo}$l(Z%a(wUWasyO-Vi(TgoB^gL@oo{jmh&{Z}aykGHMer*_isM@o*t zxE~^dcQ>~0xz5~cx8_(c6aNf#%y&*ehEA2@@k?e%RBkDzx7=5^sA#e|hui4aMY$}`E@KsPxKlfkB&*w2X$`ipHga)* zre}|@S(xgTODL=M?Rb8z-tkxLs3mc5j)y!m70Wy#$rxt=GMYMb$?P^n-0hU97xMD> z`EwmVO*XKx*{CD5{dG_YO(+f~wL@ot@1uLo(ExBC-_0Ks*h946)0wWG#PE;k>ys{QUM5ZhV&_R?r!Pd3&`!@1 zG>6y-Qbg#N&joIId{o2E_DA5mt>1o+KouC#K^*1LAg1goO%FasF1*v#&w|-uD)N%e zK_C`0+u6V&zKrOC81fT#5P|dDeXf2?XG}&FSxEuj+>9D<#v@~x%v&!pzEHt@^$Nma z5z1)*U?QWm+NcfmeeQWbm&e7cM}c+fFW>1nuv{G3Mb-^mt%>jb`53q~(#_*vDB!O4 zyEN;9@iENv=Ih;PS$svoBY5b-=)T>Ec4&9bDy25p%lqZ}Ap1_`|NN-sDB2t*0bNld z$T@WaO29;`g||Nx9sjeYkG3-yM(Pu55lPT#lCq{RV1Y4K_p(~zwfe&?xqHf>{FXhJ zua<{eWb4>B2vT{dj4bE@k6xl8NjlFw)P1ttd$`Kqh9y*p99ueggu)KIILl4 zI#JshaTg-#j(YYh4=4+TQC=7g7oXrN6vg0!66QD#>-kg3E zf@mgHv6lsSying4|62eWZarpUGysijB5Ey<0Y~$@jA(9Qy35ntPcW~M64k0zU@DGM z=wHx>B+_pz4kiSGl!103pFx$+-;2C6uhknj?tXk2rrAfKQB$0_=-LA2+2YWtFAdWw z`gL|=FLa0AZykHdx`SIC#A~)eKQwvkbQYdMQmli8_}ar0l5FIU2jqWgC%9zi4;M)$ z!$T-1ya|9fdmzf=H1$OcH9Ea?u&+kkwP<*%X9^bo4hG##maY<|^X;P&Bc-z=Jr68h z>}}6V41J699T8h-UYwJv$n*OU@cmR?Zp-8HjiqBjJuid({n*hJu^K) zsb%VA!t|);&BqrmXB62^yOvEp=~gzq*-nnP4tIX%jm0Dkaie}2*_8r>ulWbHQJTXvvtW@YL3)lTt zTRTy*$d(t|j+Hok*4(?-r27y6v|hEeZ0N>W*;g!U&0ys+ zaYt)J)PKI&|8oA!h5Ne&2Y)-`@USO%q6f9&RUIvCD4>Rhyf`GPGtn6@IZ`}fdDp6P zHiFNIR5iaYX5wocb4JuL4;aG2B?$(Uq@p9Nj=a*}Z~uvIEpI@^`TzOQykJrlVY*Lq zIDBO5Jp#ljM(?~V4j0Lr>-=T(Px@%*6m3*pE>n}J={vGT9xrgdt-+j5kE`G3pTSo( zeiLs#*7d<~eT9tv^u=14YDpCUY$`%d*FPxW1a3MU8s?`Fikwlt&fLVWz(-T42=a}GhKqijVGGRWdc;n z!sP|?Lgu_=2q+~n)Pxh$CIOpGMqlOEI!3WD-08oLk5rtp0sXHGgZb~Pkta)q;+*~m z7^Z^k6_IqnyN@9~A2-~Nx6%z!&yk@Xg^x#PwC4<=#2S|0>`Y(cioro5+;>ZZ2v6CW zGYwS=GFs3OFbTVst%ho``qi$<-Mk4;l%0dh|5Kh}R3j<+n{$+-fKDmB%GLWJuw{0x7EpU)Lrw zUPoKpCpZAIyS(?NIMmXEft!3z=-T6qEVpE4fPpgTvnn8-m{~|Xk)xpkB(1_3m2V=z zir+}T%bdK4ufZH;1X-IHTA%~IqT$1*PY5rmm`pllM)?@$Yo`&g;CIwr{6YCaXo@U% zC@RruvFlqbyKmdf)w?b73_wwP^W_ndL8ohtrV9xf>&nSyLQi& zuPeqk7+%nXeI~m;p|f#-!xl_Px8F}aPx308wYut*eceg{Cvn5+HZqYNKBS4nIFRoR(JH~{$Kz-h6_atlNPbNX&UT4dmW z;CE9PUF9Y+{D0eQY7KEdw_)sS+`sQ1-6li>wQRw{gwCQFd-SeGMANcnc6|JE(X^jl zeUKpl!%_I=VAHFARKtf}@6O_%))B3ayElW%hDkE}{@1ZjcNa#+hF;X}&Ju5bx1H?& zCUf(wNvfx6w9|K17VVOSlR$UX2=#nLaBuJ3aPJR*FLLRPf#jy*8vV zTZEf)>nLEQGc|6iLA1x!ZpwYSRE*J$u#jzxZ0>B>vxLHz+c0c&0KKTq>AKNi$w|yh zWXcIt9!Dy`!dPLAbJaT&N}^qXIy9URa`q~2ID2(Gw0VgeF;2JHO)gBIp$ArZRkv2G zmB?-&?qM(!g~hQ1VJYS@DF$2*w-9sxValOji7s;;esn*Ux%t^ZNicMe;AC&uIr5Q$ zm)PDc{q-P{9?3Iy1+f7z$A+6CJF_C_r~{5hkS!p{LoPV%Yi(cz{Z56A{ZCRAX-x9a zvIH^)o;1M}`?RZ&GFRze^aBI0^{Ogs5XZM1hYj!vi!T$XMtLy7!`5v=TEwWJ&rh|0 zQbNNTwxBQ|qtf{`hy^A+>-Zt{`E`BQQ28LB`1GUQ&&lK6e^|__L6K40&?O7&rg5=p zFMx>)5+SbD&>5@OIC(G2oBJ9p_JBMUCJsq2zH2TD1b$-+i{A)(nws?^Hb6i(Wv!U^ zJs4tJ%J2yQj&BBF{|@)Zz3$2i-E!Wrp5gdbYM6_*_tQPTve#xk<0{-fN zD{E=|FJS|JgQ2m}Oq!)oy%*@_*D>h-+Zy5I1y{ee4-E!EldOg6B_$4eE1YQq% za$d5PNb2`!i!tWxJlSj98z2CzPrGkHCqjHXzs%IU0!-^*n35(INzeV2Exx3d6S(2R zvz)P|`WWUaluU+=rE>P;gPk!&5&l4hL#Iy$DtW$?0qJb5BuB#?h2`a_0!Yx zk`j{M-}FgUdyCDr4*;g(eUpbe0_ku>Rdq8V&h>k&RXMS0 z=(VI98-#K99ztvYqiqQK{3_W5n%MJnZ5;k`-+7DW+yC2W4I+E-SPHFS8iz@S%9FC= z#n!E!wEF#FN1gSEDGJ*w1Vx2~rLKJjnEda-uHoyEbeCs&Mj7{4b>ayxEr7)!JpyES1X;B^?WX^ti94Q@P9&aw!4Xho`r2R5O;JIpEp^5MMG&Fv6Sp*Ma~0O(Tc z;~I)!N}iQxQ0KLX_R_Dba$(XHd2}%q4Eax3O`SaCUyShh?=L|8;pLyPiqT^x zYXvl0XRC-+LHrwO#!a0Xwfkm=#$M>KCaQ?~p8%=?Li~z|E{pi}(W}(AWv*gddj`9| z-}EY()vid|Hy`EnENTEnH73sVNX=wa*v4P!y>+zs^274}Z{G|8hMX&ACKfuIwkNe& zPsql#397o@Do?eU|It%2I-k-r?CSe-OrmQ%wj$Qc-|=0c*~Zqn^DO~$Zv#a4O+@KP zEYunV*s|}76Swy)gd#hCJy=w6@^73@RKL17*4A9=ncw%oQsMEw+T`enO1Q6mF~k2n zy3GBTLBQl&6O&)B-5cf97j7BoYKGQFFTWIoql)u~N{#PNu?Xh8{DXp30DI@hc}r+N z6rIDgrsX%LUcsoxMopZTh7Lmn(V3T*Ur