Merge remote-tracking branch 'origin/main' into docs/verified-assistant-installs

Author: mraible

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "crowdstrike-falcon-fusion",
       "source": "./",
       "description": "CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema validation, workflow import and release, execution monitoring, and Falcon Next-Gen SIEM lookup files.",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "author": {
         "name": "CrowdStrike"
       },

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "crowdstrike-falcon-fusion",
   "description": "CrowdStrike Falcon Fusion skills for authoring, deploying, and executing Fusion workflows. Includes live action discovery, YAML authoring with schema validation, workflow import and release, execution monitoring, and Falcon Next-Gen SIEM lookup files.",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": {
     "name": "CrowdStrike"
   },

.github/workflows/main.yml

@@ -18,7 +18,7 @@ jobs:
         run: command -v shellcheck || { sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck; }
       - name: Run ShellCheck
         run: |
-          shellcheck hooks/*.sh bin/*.sh
+          shellcheck hooks/*.sh scripts/*.sh
           shellcheck --severity=error *.sh
 
   test-hooks:
@@ -69,7 +69,7 @@ jobs:
             --cov=skills/deployment/scripts \
             --cov=skills/execution/scripts \
             --cov=skills/lookup-files/scripts \
-            --cov=bin \
+            --cov=scripts \
             --cov-report=term-missing \
             --cov-fail-under=90
 
@@ -95,7 +95,7 @@ jobs:
             skills/deployment/scripts/*.py \
             skills/execution/scripts/*.py \
             skills/lookup-files/scripts/*.py \
-            bin/*.py
+            scripts/*.py
 
   validate:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.1.0] - TBD
+
+### Added
+
+- US-3 cloud region to credential setup: a `[us-3]` profile example (`https://api.us-3.crowdstrike.com`) in the setup skill's multi-cloud block and in the README region notes, alongside a `[us-gov-1]` example that was also missing. The auth module already accepts any `base_url`, so this documents the host rather than changing behavior.
+- Throttling reference in the execution skill: explains that a workflow stuck "in progress" may be throttled (Fusion paces an action past a volume limit, auto-retrying up to 6 hours) rather than failed, how to recognize it on the execution detail view, and when sustained throttling signals a workflow-design issue.
+- Deduplicate and Rate Limit action reference plus a worked tutorial example. Covers all six Deduplicate activities and all four Rate Limit activities: the `definition`/`cid` scope values (which the console labels "Workflow" and "CID"), the atomic claim, metadata handoff, and the save-time validation the builder runs. The example deduplicates third-party NG-SIEM detections into a single case. Action IDs were confirmed against a live tenant; the example passes validation at all tiers.
+
+## [1.0.1] - 2026-08-07
+
+### Fixed
+
+- Relocated helper scripts from `bin/` to `scripts/` so the plugin installs on claude.ai and Cowork. A top-level `bin/` directory is added to the CLI's PATH but isn't shown on the web admin approval surface, so those hosts rejected the plugin. The scripts are internal helpers, not entry points, and moving them out of `bin/` clears the block. Command-line installs were unaffected.
+
+### Changed
+
+- Renamed the deployment skill from `deploy` to `deployment` so it matches its sibling skills (`authoring`, `execution`) and the `foundry-skills` convention. The command is now `/crowdstrike-falcon-fusion:deployment`; the picker no longer rewrites `:deploy` to `:deployment` on submit.
+
 ## [1.0.0] - 2026-07-30
 
 First public release of Falcon Fusion Skills — AI coding assistant skills for building CrowdStrike Falcon Fusion workflows. Describe the automation you want in plain language and your assistant discovers the real action IDs from your tenant, writes the YAML, validates it against the platform schema, imports it to your CID, and runs it.
@@ -33,4 +51,6 @@ First public release of Falcon Fusion Skills — AI coding assistant skills for
 
 - Tested with Claude Code. Experimental setup instructions for Codex, Copilot CLI, Cursor, and Antigravity CLI, written from each tool's own documentation but not yet verified end to end. The skills are plain markdown, so any assistant that reads local files can use them.
 
+[1.1.0]: https://github.com/CrowdStrike/fusion-skills/releases/tag/v1.1.0
+[1.0.1]: https://github.com/CrowdStrike/fusion-skills/releases/tag/v1.0.1
 [1.0.0]: https://github.com/CrowdStrike/fusion-skills/releases/tag/v1.0.0

README.md

@@ -2,7 +2,7 @@
 
 # Falcon Fusion Skills
 
-![Version](https://img.shields.io/badge/version-1.0.0-blue)
+[![Version](https://img.shields.io/badge/version-1.0.1-blue)](https://github.com/CrowdStrike/fusion-skills/releases/tag/v1.0.1)
 [![CI](https://github.com/CrowdStrike/fusion-skills/actions/workflows/main.yml/badge.svg)](https://github.com/CrowdStrike/fusion-skills/actions/workflows/main.yml)
 
 AI coding assistant skills for building [CrowdStrike Falcon Fusion](https://www.crowdstrike.com/en-us/platform/next-gen-siem/falcon-fusion/) workflows. Go from a natural language prompt to a working Fusion workflow — discover real action IDs from the live API, author the YAML, validate it against the platform schema, import it to a CID, and trigger and monitor its execution.
@@ -56,6 +56,7 @@ For CI or a one-off override, set environment variables instead:
 export FALCON_CLIENT_ID=your_client_id_here
 export FALCON_CLIENT_SECRET=your_client_secret_here
 # export FALCON_BASE_URL=https://api.crowdstrike.com  # US-1 (default)
+# US-2: https://api.us-2.crowdstrike.com · US-3: https://api.us-3.crowdstrike.com · EU-1: https://api.eu-1.crowdstrike.com · US-GOV-1: https://api.laggar.gcw.crowdstrike.com
 ```
 
 Credentials come from environment variables (checked first) or the TOML profile, and are never hardcoded. Verify your setup:
@@ -171,7 +172,7 @@ The skills include hooks that ensure the right skills get used:
 
 3. **`PreToolUse` hook (cross-plugin bridge)** — Advisory only. If a request needs a Foundry app (UI, functions, collections, `manifest.yml`), it suggests the sibling [`crowdstrike-falcon-foundry`](https://github.com/CrowdStrike/foundry-skills) plugin. It never blocks a skill.
 
-The `workflows` orchestrator is the entry point: you say what you want, and it routes to `authoring` (discover actions, write and validate YAML), `deploy` (import and release to a CID), and `execution` (trigger and monitor). Hooks observe prompts and tool I/O to keyword-match Fusion actions; no data leaves the session.
+The `workflows` orchestrator is the entry point: you say what you want, and it routes to `authoring` (discover actions, write and validate YAML), `deployment` (import and release to a CID), and `execution` (trigger and monitor). Hooks observe prompts and tool I/O to keyword-match Fusion actions; no data leaves the session.
 
 ## Skills
 
@@ -181,7 +182,7 @@ One plugin provides five skills: an orchestrator plus four focused sub-skills.
 |-------|---------|
 | `workflows` | Primary orchestrator — routes intent and coordinates the full workflow lifecycle |
 | `authoring` | Action discovery (`action_search.py`), YAML authoring, CEL expressions, schema validation (`validate.py`) |
-| `deploy` | Duplicate check, import to CID, release, version management |
+| `deployment` | Duplicate check, import to CID, release, version management |
 | `execution` | Trigger workflows with payloads, monitor status, tail logs, debug failures |
 | `lookup-files` | Manage Falcon Next-Gen SIEM lookup files (CSV/JSON/TXT) for CQL `match()` queries |
 
@@ -205,7 +206,7 @@ graph TD
     style LF fill:#f59e0b,stroke:#d97706,color:#fff
 ```
 
-A typical lifecycle: `authoring` produces a validated YAML file → `deploy` imports it and returns a `definition_id` → `execution` triggers it and returns an `execution_id`. Each phase depends on the previous one's output.
+A typical lifecycle: `authoring` produces a validated YAML file → `deployment` imports it and returns a `definition_id` → `execution` triggers it and returns an `execution_id`. Each phase depends on the previous one's output.
 
 ```
 skills/
@@ -289,7 +290,7 @@ python common/scripts/auth.py          # Verify credentials resolve and a token
 /crowdstrike-falcon-fusion:setup        # Re-run interactive credential setup (Claude Code)
 ```
 
-Confirm `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` are set in your environment or TOML profile, and that `FALCON_BASE_URL` points at the correct cloud (US-1 is the default; set it for US-2, EU-1, or US-GOV).
+Confirm `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` are set in your environment or TOML profile, and that `FALCON_BASE_URL` points at the correct cloud (US-1 is the default; set it for US-2, US-3, EU-1, or US-GOV).
 
 ### Stale action cache
 

common/scripts/_bootstrap.py

@@ -2,14 +2,14 @@
 
 The skill's Python scripts depend on `crowdstrike-falconpy` (and `pyyaml`). Those
 live in a managed virtualenv at ``~/.cache/claude-code-fusion/venv``, created by
-the plugin's SessionStart hook and used by ``bin/python.sh``. But a script may be
+the plugin's SessionStart hook and used by ``scripts/python.sh``. But a script may be
 launched with a bare ``python script.py`` — for example from a cloned repo in dev
 mode, where the plugin hook never fired — using an interpreter that has no
 falconpy installed. That produces a ``ModuleNotFoundError`` at the first API call.
 
 ``ensure_deps()`` makes the scripts resilient to how they are launched: if the
 marker dependency (``falconpy``) is missing from the current interpreter, it
-re-executes the script through ``bin/python.sh``, which runs (and, on demand,
+re-executes the script through ``scripts/python.sh``, which runs (and, on demand,
 builds) the managed venv. If falconpy is already importable — the normal case,
 including when already running inside the venv — it does nothing.
 
@@ -33,13 +33,13 @@
 
 
 def _python_sh_path():
-    """Absolute path to bin/python.sh, resolved relative to this file.
+    """Absolute path to scripts/python.sh, resolved relative to this file.
 
     This module lives at ``<repo>/common/scripts/_bootstrap.py``; the wrapper is
-    at ``<repo>/bin/python.sh``.
+    at ``<repo>/scripts/python.sh``.
     """
     here = os.path.dirname(os.path.abspath(__file__))
-    return os.path.join(here, "..", "..", "bin", "python.sh")
+    return os.path.join(here, "..", "..", "scripts", "python.sh")
 
 
 def ensure_deps(script_path):

hooks/bootstrap.sh

@@ -5,8 +5,8 @@
 
 PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
-"$PLUGIN_ROOT/bin/setup-python-venv.sh" >&2 || {
-    echo "fusion-skills: venv bootstrap did not complete; scripts may need a manual venv setup (bin/setup-python-venv.sh)." >&2
+"$PLUGIN_ROOT/scripts/setup-python-venv.sh" >&2 || {
+    echo "fusion-skills: venv bootstrap did not complete; scripts may need a manual venv setup (scripts/setup-python-venv.sh)." >&2
 }
 
 exit 0

release.sh

@@ -162,6 +162,9 @@ main() {
   # Use portable sed with temp file pattern (macOS and Linux compatible)
   sed 's/badge\/version-[0-9.]*-blue/badge\/version-'"$NEXT_VERSION"'-blue/' "$SCRIPT_DIR/README.md" > /tmp/README.md.tmp
   mv /tmp/README.md.tmp "$SCRIPT_DIR/README.md"
+  # Update the badge release link target
+  sed 's|releases/tag/v[0-9.]*|releases/tag/v'"$NEXT_VERSION"'|' "$SCRIPT_DIR/README.md" > /tmp/README.md.tmp
+  mv /tmp/README.md.tmp "$SCRIPT_DIR/README.md"
   printf "${GREEN}✓${RESET} README badge → v${NEXT_VERSION}\n"
 
   printf "\n${BLUE}Step 3: Update SKILL.md versions${RESET}\n"

run-ab-test.sh

@@ -93,7 +93,7 @@ find_workflow_file() {
 
 # Clean up deployed Fusion workflows from a phase directory.
 #
-# Deletes via the Workflows delete API (bin/cleanup_workflows.py, FalconPy
+# Deletes via the Workflows delete API (scripts/cleanup_workflows.py, FalconPy
 # delete_definitions) — no browser. Collects the workflow names deployed by each
 # run in the phase, then deletes them by name. Skipped entirely in --skip-deploy
 # mode, where nothing was imported.
@@ -109,17 +109,22 @@ cleanup_phase_workflows() {
     local wf_file wf_name
     wf_file=$(find_workflow_file "$dir")
     [ -n "$wf_file" ] || continue
-    wf_name=$(grep -m1 -E '^name:' "$wf_file" 2>/dev/null | sed -E "s/^name:[[:space:]]*['\"]?(.+?)['\"]?[[:space:]]*$/\1/")
+    # Strip the "name:" prefix and any surrounding quotes. Uses three simple
+    # substitutions rather than one lazy-quantified capture group, because BSD
+    # (macOS) sed rejects the '.+?' non-greedy operator with "RE error:
+    # repetition-operator operand invalid".
+    wf_name=$(grep -m1 -E '^name:' "$wf_file" 2>/dev/null \
+      | sed -E "s/^name:[[:space:]]*//; s/^[\"']//; s/[\"'][[:space:]]*$//")
     [ -n "$wf_name" ] && names+=("$wf_name")
   done
 
   if [ ${#names[@]} -eq 0 ]; then
     return 0
   fi
 
-  local cleanup_py="$REPO_ROOT/bin/cleanup_workflows.py"
+  local cleanup_py="$REPO_ROOT/scripts/cleanup_workflows.py"
   if [ ! -f "$cleanup_py" ]; then
-    echo "  NOTE: bin/cleanup_workflows.py not found — skipping cleanup."
+    echo "  NOTE: scripts/cleanup_workflows.py not found — skipping cleanup."
     echo "        Remove these manually in Falcon console → Fusion → Workflows:"
     printf '          - %s\n' "${names[@]}"
     return 0