Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate.
AI assistance: Codex, under maintainer direction.
* Add DeepSeek Harness as a supported skills provider
npx impeccable install now detects ~/.dsh (or $DSH_HOME when it sits
under home) and installs into ~/.dsh/skills, the user-level skill root
DeepSeek Harness scans, with project-level .dsh/skills on the same
layout as other providers. Aliases: dsh, deepseek, deepseek-harness.
Engine: PROVIDER_DIRS / aliases / display / input order / global hint,
$DSH_HOME-aware user skills dir, provider id resolution from the skill
dir, pin harness dirs, bundle path normalization for hashing.
Build: dsh transformer target emitting the frontmatter DeepSeek Harness
reads (user-invocable, license, compatibility, metadata; unknown keys
are ignored there) with no emitHooks (DSH hooks are in-process plugins,
not on-disk manifests) and no agentFormat (no documented on-disk
subagent format); placeholders (AGENTS.md config file, ask_user_question
tool, / command prefix), provider block tags, universal README entry.
Docs: HARNESSES.md row and frontmatter column, CLI-CONTRACT constants,
README/DEVELOP/AGENTS provider lists.
Validation: cargo test --workspace; node scripts/run-tests.mjs core
(138 pass); bun run build (19 providers, dist/dsh artifact verified);
engine smoke against a fake HOME with a local bundle: install
--providers=dsh --scope=global, auto-detected install, and update all
resolve the .dsh provider.
Generated provider output intentionally omitted per repo policy; the
sync workflow regenerates tracked .dsh/skills after merge.
Prepared with AI assistance (DeepSeek Harness coding agent).
* Address review: DSH_HOME-only detection, generated-output pathspecs
- Detect DeepSeek Harness through the resolved $DSH_HOME (fallback
~/.dsh) instead of gating on a fixed ~/.dsh path, so a DSH_HOME-only
setup is offered by a provider-less install; generalize the two
env-relocated config-dir hints (OpenCode, DSH) into one shared probe.
- Add .dsh to the sync workflow's GENERATED_PATHS and CI's generated
drift check so the tracked .dsh/skills payload is committed and
validated.
- Cover both behaviors: new install_detection_tests (DSH_HOME-only,
default ~/.dsh, refused outside-home override) and a CLI-CONTRACT
note on the resolved detection path.
Validation: cargo test --workspace; node scripts/run-tests.mjs core
(138 pass); engine smoke: DSH_HOME-only fake HOME installs globally
into the resolved skills dir.
Prepared with AI assistance (DeepSeek Harness coding agent).
* Fix DeepSeek Harness home paths on Windows
Use native relative-path containment, cover case and drive boundaries, and verify relocated global install/update without changing project skills. Add DSH output coverage and correct the install documentation.
AI assistance: Codex, under pbakaus maintainer direction.
* Document the CLI limit on external DSH homes
Clarify that outside-home manual copies are not detected or updated by the CLI.
AI assistance: Codex, under pbakaus maintainer direction.
---------
Co-authored-by: Paul Bakaus <paul.bakaus@gmail.com>
The sync's GENERATED_PATHS list was missing .agent, .codex, .veto,
.github/agents and .github/hooks, so the run after #714 regenerated the
other provider directories but left those carrying the Node-era hook
manifests and scripts, and main's CI failed on the hook-manifest and
provider-hook tests. The list now matches what bun run build:release
writes, and this commit carries the regenerated output for the missing
paths so main is consistent as soon as it lands.
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
Co-authored-by: Claude Code <noreply@anthropic.com>
Impeccable now ships a Hermes-compatible bundle under dist/hermes/.hermes/skills/.
Hermes reads the Agent Skills spec as-is, so the bundle uses the four spec
frontmatter fields (name, description, version, license) plus metadata/compatibility
and drops the Claude/Codex-specific extensions Hermes would silently ignore.
The .hermes/skills/ tracked root and the regenerated pin.mjs mirrors will be
produced by .github/workflows/sync-generated-output.yml after this lands; per
AGENTS.md, generated harness churn stays out of feature PRs.
What a Hermes user gets:
- npx impeccable install --providers=hermes --scope=project writes
.hermes/skills/impeccable/ into the cwd.
- npx impeccable install --providers=hermes --scope=user honors $HERMES_HOME,
so a profile-scoped install (HERMES_HOME=~/.hermes/profiles/forge) lands in
the active profile's skills dir, not the default ~/.hermes/. Cross-home
HERMES_HOME inheritance is ignored so test isolation holds.
- /impeccable registers as a Hermes slash command and routes sub-commands via
the Commands table in the skill body, since user-invocable / argument-hint
are not honored by Hermes' skill loader.
What a Hermes user does NOT get, and why:
- No hook surface. Impeccable's PostToolUse/Stop anti-pattern detector on
Claude/Codex/Cursor/Grok/GitHub does not translate to Hermes, which has no
equivalent tool event lifecycle. The skill body still ships.
- No writeOpenAIMetadata, agentFormat, or emitHooks. Hermes has no per-skill
tool ACL, no subagent on-disk format, and no hooks.json equivalent.
Verified end-to-end with hermes-agent v0.18.2: /impeccable polish and
/impeccable critique both load reference/<command>.md and return the
documented first step. parse_frontmatter accepts the generated SKILL.md,
scan_skill_commands registers /impeccable, and the full default test suite
passes (267/267 in the critical files; 0 fail across all suites).
Both bots caught the same false report: the summarize step ran off the
initial drift flag, so the no-drift-after-rebuild exit still claimed a
commit landed on main. The commit step now records pushed=true/false in
its step output and the summary reads it.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Copilot's two review points: the fifth attempt performed a full
reset + install + rebuild + 25s backoff that nothing would ever consume
before the job failed, and the retry message blamed "main advanced"
when the combined condition also fails on push errors (network, auth).
The loop now breaks before recovery on the final attempt, and both the
retry and terminal messages name the two possible causes.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The sync workflow built once from the checked-out main and aborted when
a human commit landed during the ~30s build window (about 10% of runs
per the evidence in issue #388), leaving generated provider output
stale until the next unrelated push re-triggered it.
The commit step now loops up to five times: on a lost race it resets
hard to the fresh origin/main (source included), re-installs and
rebuilds, and pushes again with linear backoff. Every attempt therefore
builds from the main it will land on, which is the invariant the old
abort guard protected; the merge-base check stays inside the loop as
the pre-push verification. When the rebuilt output shows no drift (the
racing commit was another sync, or the new source produces identical
output) the step exits cleanly instead of committing an empty sync.
Validated by yaml-lint, bash -n, and a local three-repo simulation
(bare origin + worker + racer) confirming the lost race rebuilds
against the racer's source and lands matching output on attempt two.
Retry design proposed by @mktdgtbrz in #388; implemented from the
description with the no-drift early exit added.
Prepared with AI assistance (Claude Code), directed by @pbakaus.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Emit .grok skills, agents, and PostToolUse/Stop hooks; wire the CLI
installer and downloads; fix the plugin install path to #plugin; and
document Grok in HARNESSES.md and README.
AI assistance: written with Grok Build.
* feat: add Mistral Vibe harness support
Mistral Vibe is Mistral AI's open-source CLI coding assistant that ships an
Agent Skills system at .vibe/skills/{name}/SKILL.md with slash-command
invocation, mapping cleanly onto the existing transformer pipeline. Adds
Vibe as a 14th first-class harness:
- PROVIDER_PLACEHOLDERS entry in scripts/lib/utils.js (model, config_file
= AGENTS.md, ask_instruction, command_prefix) mirroring the Qoder shape.
- PROVIDERS entry in scripts/lib/transformers/providers.js with configDir
.vibe and frontmatterFields user-invocable, license, compatibility,
metadata, allowed-tools (Vibe docs do not document argument-hint).
- transformVibe named export in scripts/lib/transformers/index.js for
test-spy parity.
- vibe added to FILE_DOWNLOAD_PROVIDER_CONFIG_DIRS so the download
endpoint accepts /api/download/skill/vibe/* and resolves to
dist/vibe/.vibe/.
- .vibe added to PROVIDER_DIRS, PROVIDER_ALIASES, PROVIDER_DISPLAY,
PROVIDER_INPUT_ORDER, GLOBAL_HARNESS_HINTS, and the normalizeForHash
provider regex in cli/bin/commands/skills.mjs so the CLI detects
existing Vibe installs.
- docs/HARNESSES.md updated: official docs row, frontmatter support
column, directory structure row, and Last verified date bumped.
- docs/DEVELOP.md, README.md (install instructions, providers list,
Supported Tools), .github issue/PR templates, sync-generated-output
workflow, and AGENTS.md extended with Vibe.
The dynamic providers.test.js loop picks up Vibe automatically; all 160
provider tests pass including the 14 new Mistral Vibe cases. The build
regenerates dist/vibe/.vibe/skills/impeccable/ with correct frontmatter
and .vibe-substituted script paths. Generated harness output is left
unstaged per the source-first policy; the sync-generated-output workflow
(now listing .vibe) will commit it back to main after merge.
Co-Authored-By: Mistral Vibe <noreply@mistral.ai>
* Address review on Vibe harness support
Verified the Vibe claims against the docs and the mistralai/mistral-vibe
source, then tightened what the tables say.
- model placeholder: 'Mistral', not 'the model'. Vibe is Mistral's own
first-party CLI, so it belongs with gemini -> Gemini and codex -> GPT
rather than with the provider-agnostic harnesses. SKILL.src.md's one
use of {{model}} now renders 'Mistral is capable of extraordinary
work.' instead of a lowercase 'the model'.
- Docs links point at the skills page, not the product overview, matching
every other row in both tables.
- disable-model-invocation is No, not TBD. The field appears nowhere in
Vibe's source; unknown frontmatter keys are silently ignored.
- Split the directory row into project and global scopes the way the Pi
row already does. Vibe reads .vibe/skills/ and .agents/skills/ at the
project level and ~/.vibe/skills/ and ~/.agents/skills/ globally; the
global .agents dir was missing, and project .agents/skills/ was sitting
in the global column. Sources: vibe/core/paths/_local_config_files.py
and vibe/core/config/harness_files/_paths.py.
- Restored 'Last verified' to 2026-04-28 and dated the Vibe row on its
own. Only that row was checked, and this file warns against trusting
stale claims, so a blanket re-date made ten other rows look fresher
than they are.
AI assistance: written with Claude Code.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Mistral Vibe <noreply@mistral.ai>
Co-authored-by: Paul Bakaus <paul.bakaus@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Upgrade actions/setup-node to v7 across CI, sheriff, and generated-output sync workflows.
The action migrated to ESM and updated its cache internals; existing inputs required no migration. The PR's full exercised CI matrix passed on v7, and all changed workflows passed local YAML validation.
AI assistance: Codex performed dependency review and validation under maintainer automation instructions.
Paul BakausandGitHub
Forgeandplamb
dependabot[bot]andGitHub
