End-to-end audit: version drift, CLI hardening, npm packaging, CI, dependency security - #5
Merged
MrSpacemann merged 2 commits intoJul 2, 2026
Conversation
- CLI reads its version from package.json at runtime (createRequire) — the hardcoded string had drifted (npm 0.1.13 reports 0.1.12); drop the double-bump step from CONTRIBUTING and switch to parseAsync - Deduplicate openai/grok/kimi adapters into an exported openaiCompatibleAdapter(platform) factory (they were byte-identical) - install: validate skill-name format on the typed arg (fail fast, before network) and on the response name before it shapes fs paths (blocks traversal from a malicious registry, e.g. backslash names on Windows); state-machine header updated - search: include numeric HTTP status in errors (statusText is empty over HTTP/2) and handle invalid-JSON responses cleanly - publish: warn on unknown adapters (parity with build) - init template: drop "main": "./src/index.ts" — init never scaffolds it - getting-started: bump 1.0.7 -> 1.0.9; published 1.0.8 is stale and teaches --sort downloads which the API rejects, and 1.0.7 < 1.0.8 blocked republishing the corrected content (needs a publish to go live) - npm packaging: license/repository/homepage/bugs/keywords/engines + per-package README and LICENSE (both npm pages currently render bare) - Add GitHub Actions CI (pnpm build + test on Node 20/22) and pin packageManager - Wiki: landmines for version source-of-truth and skill publish drift Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pnpm -r update within existing majors. Covers the shipped runtime deps (tar 7.5.19 file-smuggling fix for the CLI; ajv 8.20.0 ReDoS + fast-uri 3.1.3 traversal fixes for core) and the dev-only chain (vitest 3.2.6 critical UI-server RCE, vite 7.3.6, esbuild 0.28.1, rollup 4.62.2, postcss 8.5.16, picomatch 4.0.4). Build + full test suite green on the updated tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Full repo audit with fixes. Two commits:
Audit fixes (ef16fde) — reviewed clean by the code-review gate:
openaiCompatibleAdapter(platform)factory (they were byte-identical)installvalidates skill-name format on the typed argument (fails fast before network) and on the response name before it shapes filesystem paths (blocks traversal from a hostile/misbehaving registry)searcherrors include the numeric HTTP status (statusText is empty over HTTP/2) and handle invalid-JSON responses cleanlypublishwarns on unknown adapters (parity withbuild)inittemplate no longer references a./src/index.tsit never scaffolds--sort downloads, which the API rejects) and blocked republishing; needs an authenticatedpolyskill publishafter mergeDependency security (3bd1889) — resolves all 15 open Dependabot alerts (1 critical, 7 high) via in-range updates; build + 127 tests green on the updated tree. Supersedes Dependabot PRs #1 and #3.
🤖 Generated with Claude Code