* Release engine 0.1.5, CLI 4.1.0 and skill 4.3.0
Ship GPT Image 2.5 Flare and native transparent assets. Refresh generated provider distributions for the release.
Prepared with AI assistance under the maintainer's instructions.
* Fix: lock released engine platform packages
Regenerate all five 0.1.5 platform resolutions after npm publication and verify frozen installation.
Prepared with AI assistance under maintainer instructions.
* Use GPT Image 2.5 Flare for image generation
Add explicit model selection and cover generation/edit request provenance. Compare 24 comp samples with Image 2 and Sunburst, documenting efficiency gains and the photo-preservation tradeoff.
Prepared with AI assistance under maintainer instructions.
* Validate native image transparency for asset production
Add repeatable cutout, glass, and reference-plate experiments with alpha measurements and compositing evidence. Record fidelity limits and the remaining asset-producer integration work.
Prepared with AI assistance under the maintainer instructions.
* Add native transparent PNG asset generation
Wire background options through generation and edits, preserve alpha, and update asset production to use supported commands with visual cutout checks.
Prepared with AI assistance under the maintainer's instructions.
* Fix native alpha review findings
Validate PNG paths for all background modes, score sparse and partial alpha over the sampled ground, and correct launcher and plate workflow guidance.
Prepared with AI assistance under the maintainer's instructions.
* Fix launcher paths in comp workflow commands
Quote existing launcher filenames for the target shell while retaining multiword command prefixes. Cover relative and absolute paths and actual shell argument parsing.
Prepared with AI assistance under the maintainer's instructions.
* Remove evaluation artifacts and docs from image PR
Keep the PR focused on runtime behavior, source skill instructions, and regression coverage. Preserve evaluation material locally.
Prepared with AI assistance under the maintainer's instructions.
Engine assets and all five platform packages are published and verified. Frozen install, CLI download fallback, and regression checks passed. AI assistance: Codex, under maintainer direction.
Clarify launcher fallback and completed documentation handoffs; separate bounded protocol checkpoints from opt-in browser-backed completion diagnostics. Correct fixture containment, target syntax, and artifact assertions. AI assistance: Codex, under maintainer direction.
Fixes#760. Use the existing line-based confirmation prompt on Windows instead of unsupported Unix raw mode. Preserves Unix and confirmation behavior. AI assistance: Cursor Grok 4.6 (implementation), Codex (maintainer-directed review and merge).
Fixes#367. Resolve design rules per target file in the Rust post-edit, before-edit, and Stop hooks, preserving repository fallback and session state. Credit to tylerjryan for the original report and proposed approach. AI assistance: Codex, under maintainer direction.
* Test nested Windows CSP candidate paths
Regression coverage for #761 before the path-normalization fix.
AI assistance: Codex, under maintainer direction.
* Fix Windows CSP candidate path normalization
Normalize native relative paths before slash-based CSP classification and signal output. Preserve literal Unix backslashes.
AI assistance: Codex, under maintainer direction.
* Avoid reusing stale CSP test fixtures
Retry an unused test directory on AlreadyExists without deleting or reading any pre-existing fixture contents.
AI assistance: Codex, under maintainer direction.
The engine verified TLS against the Mozilla roots bundled through
webpki-roots only, so behind a TLS-inspecting proxy (Aikido, Zscaler,
Netskope) whose root lives in the OS trust store, `impeccable update`
and `install` failed with `invalid peer certificate: UnknownIssuer`
while curl and npm on the same machine succeeded.
crates/context/src/http.rs builds one rustls ClientConfig per process:
the OS trust store (rustls-native-certs: Keychain, Windows store, the
OpenSSL paths on Linux) merged with the bundled roots. A union, not a
replacement, so a container without ca-certificates or a store that
fails to load still verifies exactly as before. SSL_CERT_FILE and
SSL_CERT_DIR replace the OS store the way they do for OpenSSL and curl.
Every HTTPS call site (bundle and signature downloads, /api/version,
/api/commands, the roll API, image generation) builds its agent from
this module; the plain-HTTP live-server calls on localhost are
untouched.
Verified against a local HTTPS server signed by a throwaway CA: trusted
through SSL_CERT_FILE the update check reaches it; without it the same
server is rejected as UnknownIssuer; with SSL_CERT_FILE pointing at that
CA or at a missing file, impeccable.style still verifies through the
bundled roots. cargo test --workspace and the oracle corpus (832) pass.
Written with AI assistance (Claude Code).
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Use renaissance-geek for the Impeccable extension and guard the publisher identity in packaging tests.
AI assistance: Codex, under maintainer direction.
* Add declarative VS Code skill extension packaging
Stage a launcher-only Copilot skill bundle, validate relocation and VSIX packaging, and keep project-install hooks out of the extension.
AI assistance: Codex, under maintainer direction.
* Document verified Copilot extension smoke test
Record the successful read-only VS Code 1.136.1 run and the reload required after initial workspace trust. Keep minimum-version and remote smoke gaps explicit.
AI assistance: Codex, under maintainer direction.
* Fix VS Code packaging test version source
Derive the provider fixture version from the skill manifest and assert the packaged skill and extension versions agree.
AI assistance: Codex, under maintainer direction.
* Fix truncated slug collisions
Prepared with AI assistance under maintainer-authorized automation.
* Preserve legacy long-slug reads
Prepared with AI assistance under maintainer-authorized automation.
* Harden legacy slug compatibility
Require target metadata before reading collision-prone legacy brief and critique paths. Add regressions for two long targets with the same pre-hash suffix.\n\nPrepared with AI assistance.
* Keep explicit access to legacy critiques
Allow identity-less pre-hash snapshots to be read by their exact legacy slug while keeping path and URL fallback identity-gated. Document the compatibility boundary and extend collision coverage.\n\nPrepared with AI assistance.
Accept eight grouped dependency updates while retaining ai 7.0.69 and its private provider stack pending provider-backed tool-loop regression validation. Frozen install, Rust engine build and workspace tests, full Bun/Node suite with local engine oracle, extension build/lint, browser probe, and exact-head CI passed. AI-assisted dependency maintenance by Codex.
Validated release workflow inputs, signing boundaries, full SHA pins, and exact-head required CI checks. v8 enforces artifact digest mismatches as errors; no workflow input migration required. AI-assisted dependency review and validation by Codex.
* Clarify permitted work after launcher refusal
Correct behavior-test skill metadata and DeepSeek output limits; document the measured remaining Gemini warning-order failure and hook download trust boundary.
AI assistance: Codex, under pbakaus direction.
* Clarify behavior harness host-modeling scope
AI assistance: Codex, under pbakaus direction.
* Preserve planning-only scope after launcher refusal
Clarify applicable setup steps and cover denied-launcher planning. Retain the observed playbook-read failure under issue #744 rather than weakening its assertion.
AI assistance: Codex, under pbakaus direction.
* Test planning fallback warning order
Require an assistant warning after context launcher denial and before fallback context reads. Cover silent, late, and unrelated warnings with deterministic tests; retain the observed Sonnet omission under #744.
AI assistance: Codex, under pbakaus direction.
Pin existing action versions to verified commit SHAs, restrict CI to a read-only repository token, and document the optional live-edit validation script. Preserve required sync/sheriff permissions and existing runtime behavior. Related to #480; extension permission assessment remains separate.
AI assistance: Codex, under maintainer direction.
Use verified first-edit baselines to distinguish pre-existing text findings from new or unknown Stop findings. Preserve dirty worktrees, bound notice rendering, and keep explicit scans unchanged. Verified with the full Rust and Bun/Node suites and real Claude Code edit-to-Stop sessions. Related to #522; keep it open until an engine release ships the fix.
AI assistance: Codex, under maintainer direction.
Document the local-development boundary and route production inspection to URL detection or the extension. Keep manual CSP allowances development-only. Related to #539.
AI assistance: Codex, under maintainer direction.
* Release: prepare engine 0.1.3, CLI 4.0.4 and skill 4.2.2
Ship the merged DeepSeek Harness, picker and launcher-refusal fixes. Intentionally refresh generated provider and plugin release metadata. Keep this branch off main until all engine binaries and npm platform packages exist; refresh bun.lock after publication. AI assistance: Codex, under maintainer direction.
* Release: lock published engine 0.1.3 packages
Refresh exact platform package resolutions after publication. All five npm binaries match the checksum-verified release assets. Addresses both lockfile review findings. AI assistance: Codex.
* Add DeepSeek Harness as a supported skills provider
npx impeccable install now detects ~/.dsh (or $DSH_HOME when it sits
under home) and installs into ~/.dsh/skills, the user-level skill root
DeepSeek Harness scans, with project-level .dsh/skills on the same
layout as other providers. Aliases: dsh, deepseek, deepseek-harness.
Engine: PROVIDER_DIRS / aliases / display / input order / global hint,
$DSH_HOME-aware user skills dir, provider id resolution from the skill
dir, pin harness dirs, bundle path normalization for hashing.
Build: dsh transformer target emitting the frontmatter DeepSeek Harness
reads (user-invocable, license, compatibility, metadata; unknown keys
are ignored there) with no emitHooks (DSH hooks are in-process plugins,
not on-disk manifests) and no agentFormat (no documented on-disk
subagent format); placeholders (AGENTS.md config file, ask_user_question
tool, / command prefix), provider block tags, universal README entry.
Docs: HARNESSES.md row and frontmatter column, CLI-CONTRACT constants,
README/DEVELOP/AGENTS provider lists.
Validation: cargo test --workspace; node scripts/run-tests.mjs core
(138 pass); bun run build (19 providers, dist/dsh artifact verified);
engine smoke against a fake HOME with a local bundle: install
--providers=dsh --scope=global, auto-detected install, and update all
resolve the .dsh provider.
Generated provider output intentionally omitted per repo policy; the
sync workflow regenerates tracked .dsh/skills after merge.
Prepared with AI assistance (DeepSeek Harness coding agent).
* Address review: DSH_HOME-only detection, generated-output pathspecs
- Detect DeepSeek Harness through the resolved $DSH_HOME (fallback
~/.dsh) instead of gating on a fixed ~/.dsh path, so a DSH_HOME-only
setup is offered by a provider-less install; generalize the two
env-relocated config-dir hints (OpenCode, DSH) into one shared probe.
- Add .dsh to the sync workflow's GENERATED_PATHS and CI's generated
drift check so the tracked .dsh/skills payload is committed and
validated.
- Cover both behaviors: new install_detection_tests (DSH_HOME-only,
default ~/.dsh, refused outside-home override) and a CLI-CONTRACT
note on the resolved detection path.
Validation: cargo test --workspace; node scripts/run-tests.mjs core
(138 pass); engine smoke: DSH_HOME-only fake HOME installs globally
into the resolved skills dir.
Prepared with AI assistance (DeepSeek Harness coding agent).
* Fix DeepSeek Harness home paths on Windows
Use native relative-path containment, cover case and drive boundaries, and verify relocated global install/update without changing project skills. Add DSH output coverage and correct the install documentation.
AI assistance: Codex, under pbakaus maintainer direction.
* Document the CLI limit on external DSH homes
Clarify that outside-home manual copies are not detected or updated by the CLI.
AI assistance: Codex, under pbakaus maintainer direction.
---------
Co-authored-by: Paul Bakaus <paul.bakaus@gmail.com>
Preserve Setup context and reference loading after launcher refusal, disclose the failure before editing, and limit Claude skill-directory substitution to SKILL.md. Add plugin-path and denied-launcher behavior regressions. Addresses part of #744 without closing its remaining scope.
AI assistance: Cursor on the original contribution; Codex on maintainer-directed follow-up fixes and validation.
Replace external fonts with system stacks and an outlined SVG logo. Adopt the light paper theme, refine Kinpaku accents, and preserve picker interactions with regression coverage.
AI assistance: Codex, under maintainer direction.
* Release: prepare signed engine 0.1.2
Bump engine and platform-package pins for the first Azure-signed Windows release. Keep this branch off main until release assets and all platform packages are published; refresh bun.lock after publication.
AI assistance: Codex.
* Release: CLI 4.0.3 and skill 4.2.1
Ship the verified signed Windows engine 0.1.2. Refresh provider/plugin version metadata and engine pins intentionally for release. All five platform packages are published and byte-verified. AI assistance: Codex.
* Sign Windows engine releases with Azure Artifact Signing
Isolate OIDC signing behind a maintainer-approved release environment and publish only verified, timestamped company-signed Windows output.
AI assistance: implemented and verified with Codex under maintainer direction.
* Clarify same-run artifact permissions
Keep least-privilege tokens: the pinned artifact actions use ACTIONS_RUNTIME_TOKEN for same-run transfers. Guard against opting into cross-run downloads and use role-based reviewer wording.
AI assistance: prepared and verified with Codex under maintainer direction.
* docs: add workflow guide for command entry points
* Refine workflow guidance into advice-only routing
Reuse the existing routing reference and docs map instead of shipping a parallel workflow catalog. Add reference-backed command comparisons, advice-only tests, and explicit-command precedence coverage.
AI-assisted maintainer revision prepared with Codex.
* Include routing guidance in behavior-test triggers
AI-assisted maintainer revision prepared with Codex.
* Constrain routing behavior tests to fixture-safe tools
Keep the real context loader but reject arbitrary host shell searches in the new advice scenarios. Preserve observable project writes and protect the staged skill; cover the restriction with offline regression tests.
AI-assisted maintainer revision prepared with Codex.
* Require actual reference reads in restricted routing tests
Do not count rejected shell reads as reference loading. Record the nine measured advice cases; explicit-command measurements remain pending the stricter retest.
AI-assisted maintainer revision prepared with Codex.
* Record measured workflow-routing baseline
All twelve focused cases pass across Claude Sonnet 5, GPT-5.6 Terra, and Gemini 3.7 Flash, including the stricter explicit-command retest.
AI-assisted verification prepared with Codex.
* Trim workflow routing guidance
Reduce added skill prose from 286 to 59 words while retaining the routing regression assertions. Record the missing-context reference-read flake and passing repeat.
AI assistance: prepared and verified with Codex under maintainer direction.
---------
Co-authored-by: Paul Bakaus <paul.bakaus@gmail.com>
Replace five repository-local test references with immutable GitHub links while preserving inline examples. Fixes#721.
AI-assisted contribution prepared with Cursor; maintainer verification and merge assisted by Codex. Verified pinned targets and matching examples, source-first build, generated links, and default tests (engine-dependent suites skipped without a local engine binary).
Keep allowed-tools in shared source and suppress it only for Claude output and the plugin. Verified against current main with provider builds, local tests, real plugin loader checks, and an activation-only Claude A/B test reproducing the original denial and successful fixed activation. AI-assisted implementation and verification under maintainer direction.
* Fix: distinguish removed launcher downloads from checksum failures
Related to #740; keep the antivirus investigation open. Add executable launcher regressions and a native Windows CI lane. AI assistance: prepared with Codex under Paul Bakaus direction.
* Fix: diagnose downloads removed during cache placement
Cover removal and truncation around rename and preserve fail-closed behavior through cache placement. AI-assisted under maintainer direction.
* Test Windows launcher hash and placement failures
Inject failures at command boundaries in a staged test copy while retaining real launcher control flow. Cover both platforms with the same assertions. AI-assisted under maintainer direction.
Ship signed skill-bundle verification, fix annotated-session checkpoint ordering, and pin all published engine platform packages. Validated with Rust, Node, browser, and provider-backed end-to-end tests. AI assistance: prepared and validated with Codex under Paul Bakaus direction.
* Verify signed skill bundles before extraction
Sign release ZIPs locally with an Ed25519 key from 1Password and pin the public trust root in the Rust installer. Reject unauthenticated downloads before extraction and preserve existing installs on failure. Document the signature-first rollout and explicit local trust paths.
AI-assisted implementation prepared by Codex at Paul Bakaus’s request.
* Fix signed-bundle review guardrails
Make keyring loading failures fatal before any download, accept standard release redirect statuses while retaining URL pinning, and require the signature sidecar before tagging. Add regressions for all three review findings.
AI-assisted changes prepared and tested by Codex at Paul Bakaus’s request.
Point runtime contributions and rule changes at crates/, document testing a rebuilt local engine, and correct the published-engine CI gate guidance. No runtime or generated provider output changes.
AI assistance: prepared with Codex under maintainer pbakaus direction.
* CLI: --version reports the npm package version
npx impeccable --version printed 3.6.0 after the 4.0.0 release because
the shim handed every argument to the engine, whose baked-in
CLI_VERSION still said 3.6.0. The shim now answers --version and -v
from its own package.json, as docs/CLI-CONTRACT.md specifies, without
locating or downloading a binary; a test covers both flags. The
engine's CLI_VERSION moves to 4.0.0 for the next engine release, with
the cli-version golden re-recorded and the delta noted.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
* CLI shim: --version wins whenever it leads, trailing arguments or not
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
---------
Co-authored-by: Claude Code <noreply@anthropic.com>
The popup, panel and sidebar carried the glyph as gold on an ink tile,
a treatment the brand uses nowhere. The site header sets the same
two-shape slash in ink straight on the paper; the extension now does
the same.
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
Co-authored-by: Claude Code <noreply@anthropic.com>
* extension: kinpaku UI for the popup, DevTools panel, sidebar and overlays
The extension still wore magenta (#d6336c on the toolbar badge, oklch(48%
0.25 350) through the DevTools panel and the Elements sidebar) and a cream
popup left over from the old dark system. It now wears the brand the site
ships in impeccable-site PR #34: paper and instruments, one light theme.
- extension/shared/kinpaku.css is the one token layer the three pages link.
Values are copied from site/styles/kinpaku-tokens.css, and the header
states the four rules that shape the rest: paper and ink, gold as
jewelry, patina carries colored text, a dark surface is a control.
- Severity has one language. An AI tell gets the detector's gold tag and a
lit gold dot; a quality issue gets patina; a scan that did not run gets
vermilion. Selectors and details are patina-deep, which clears 4.5:1 on
paper, and gold never carries text anywhere.
- Popup: neutral paper, the mark as a carved ink tile, an ink primary
button and a paper cap for the secondary, and the count in ink over a
rule that lights gold when there is something to report.
- Panel and sidebar: paper in both DevTools themes, since the brand has no
dark theme any more. The panel handles the seam instead of inverting,
with a hard top edge under .theme-dark. Segmented controls and the switch
are paper hardware: a recessed track, a raised cap, a lit gold dot.
- Overlays in the page: a gold hairline plus a soft outer glow instead of a
2px outline, and the label chip is now the tag, ink on gold in the mono
face, matching what live mode draws.
- The toolbar badge is gold with dark ink text (about 11.8:1); Chrome's
default white badge text does not clear 4.5:1 on gold.
Behavior is untouched: every id, class hook and message the popup, panel,
sidebar and content script depend on is unchanged, and the one markup
change beyond the stylesheet links is a severity class on the sidebar's
kind label. The extension smoke suite passes on all nine fixtures with no
service worker or offscreen errors, `bun run test` is green with a local
engine build, and `web-ext lint` reports the same two Firefox-only errors
and the same fifteen warnings as origin/main.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
* extension: guard setBadgeTextColor, and make the dark seam paint-only
Two review findings from #729.
setBadgeTextColor arrived in Chrome 110 and does not exist on Firefox's
action API. `chrome.action.setBadgeTextColor?.({...}).catch(...)` still
evaluates `.catch` on the undefined the optional call returns, so on a
browser without the method updateBadge raised a TypeError that escaped into
whatever asked for the badge update. Both the method and its return value
are checked now, and tests/extension-build.test.mjs pins the shape: no
`?.(...).catch`, an existence check around the call, a promise check before
`.catch`, and the gold and ink values with the magenta one gone.
The dark-DevTools seam is a fixed 2px line at the top of the sheet, above
the sticky toolbar because that is what keeps it in place while the panel
scrolls under it. It now sets pointer-events: none, so it is paint and
nothing else and the toolbar's top row of pixels stays clickable.
extension/shared/ joins the detector suite's trigger list, since the shared
stylesheet is part of extension packaging.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
* overlay: the page banner is a paper bar, not a gold fill
The last place gold was still upholstery. A full-width gold bar across
someone else's page is a fill, and the system holds gold to a mark, a line,
a lit dot, or a tag.
The banner is now paper with ink text, a gold hairline along its bottom
edge, and the detector's lit gold dot at its head, the same indicator the
panel puts on a section. Each page-level finding wears the tag the panel
gives it: gold with ink for an AI tell, a quiet gray chip for a quality
issue, with the detail beside it in ink rather than folded into the chip.
The bar carries a shadow of its own so it still separates from a dark host
page, and the standalone controls take muted ink now that they sit on
paper instead of gold.
crates/live/assets/detect-antipatterns-browser.js is the regenerated
tracked artifact, so live mode and the site's detector get the same banner.
Extension smoke: all nine fixtures pass, no service worker or offscreen
errors. bun run test green with a local engine build. web-ext lint reports
the same two Firefox-only errors and fifteen warnings as origin/main.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
---------
Co-authored-by: Claude Code <noreply@anthropic.com>
* Track the rule registry as a generated artifact
`cargo xtask bundle` already wrote the registry to `dist/antipatterns.json`
and into `extension/detector/`, but neither is tracked, so a consumer
reading this repo from a source checkout or a tarball had no way to get the
rule list without a Rust toolchain. The Rust swap made that concrete:
impeccable.style imported `cli/engine/registry/antipatterns.mjs` for its
rule count and its Slop catalog, and that file is gone.
Write the same JSON to `crates/live/assets/antipatterns.json`, next to the
in-page bundle and tracked like it, and extend `cargo xtask bundle --check`
to fail when either asset is stale. The build's rule-count check now reads
the tracked copy first and falls back to the extension copy, so a fresh
checkout validates counts instead of skipping the check.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
* Registry: wire the staleness gate into CI, harden the count read
Two review findings on the tracked-registry change.
`cargo xtask bundle --check` was never run by CI, so a rule whose name,
category, or description changed without changing the rule count could
ship a stale `crates/live/assets/antipatterns.json`. The extension job
already runs `bun run build:extension` (and so `cargo xtask bundle`) and
then asserts a clean tree; adding that file to the path list covers it
with the gate that is already there. The bundle beside it stays out: its
bytes carry a wasm module built by whatever wasm-pack and wasm-opt the
runner installed, so diffing it would fail on toolchain drift rather than
on a real change.
`readDetectionRuleCount` counted `new Set(rules.map(r => r.id))`, so a
shape change would collapse to a set of one `undefined` and read as a
one-rule registry, flagging every count claim as stale. Count only
non-empty string ids, and say "no readable antipatterns.json" when the
file is present but unparseable.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
* Registry gate: make the trigger honest, name the real count condition
The tracked-registry diff check ran on every PR, but the step that
regenerates the registry (`bun run build:extension`, which is `cargo xtask
bundle`) only runs when the detector trigger fires, and that trigger did
not list `crates/bundle`. A PR that changed how the registry is
serialized therefore never rebuilt it, and the check compared the
committed file against an untouched tree and passed on stale bytes.
Two changes. The detector trigger now covers every input the bundle
reads: `crates/(bundle|core|foundation|wasm|xtask)/` plus
`crates/live/assets/` so a hand-edit of a tracked artifact is regenerated
over. And the registry check moved into its own step carrying the same
condition as the build it validates, so it no longer claims to check
something that was never regenerated; the provider-output check stays
unconditional, because `bun run build` runs on every PR.
Separately, `readDetectionRuleCount` returns the reason it found no
count. "no antipatterns.json" covered three different conditions, and a
registry that is present but unparseable sends anyone debugging a count
failure to the wrong place. It now reports the paths it looked at, or
names the file that is not readable as JSON, or names the file that
carries no rule ids.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
---------
Co-authored-by: Claude Code <noreply@anthropic.com>
* Release: skill 4.2.0, CLI 4.0.0, extension 1.4.0
The Rust engine release. Skill 4.2.0 (no Node runtime; the launcher
resolves or downloads the pinned engine; command behavior is unchanged),
CLI 4.0.0 (npm shim over the engine; the JavaScript detector export is
gone, which is the breaking change), extension 1.4.0 (wasm rule core in
an offscreen document; new offscreen permission). The plugin subtree and
provider directories are regenerated at the new versions by
bun run build:release.
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
* extension: refresh the store listing for the wasm core (61 rules, panel-triggered scan, permission justifications)
Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
---------
Co-authored-by: Claude Code <noreply@anthropic.com>
Dependabot has 16 open alerts on main, all of them the astro ^5.0.0 pin
in two oracle workspace fixtures. Both files move to ^7.1.0, which clears
every advisory's first-patched version (the highest is 7.1.0 for
GHSA-4g3v-8h47-v7g6).
These are test fixtures, not shipped code. Nothing a user installs reads
them: the oracle stages the workspace tree as plain files and never runs
a package install, and the engine's astro detection keys on the presence
of the dependency, not its version. The live-e2e astro fixture is a
separate tree and already pins ^7.1.0, so it is untouched.
Verified with the oracle replay (zero unreviewed differences, so no
golden moved and DELTAS.md gains no entry), plus bun run build and the
default suite with IMPECCABLE_BIN set.
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
Co-authored-by: Claude Code <noreply@anthropic.com>
Paul BakausandGitHub
github-actions[bot]
Abdul WahabandGitHub
dependabot[bot]andGitHub
