Validate env -S and --split-string escape syntax before shell scanning or
opaque fallback. Preserve literal single-quoted data and charge each
validation character against the shared input-proportional work budget.
Verified 787 focused cases and 290 real Git/config, harmless native env
and registered-routing controls. Keeps the prior paid-copy protection.
Co-authored-by: Nguyen Thanh Dat <ntdat812.dev@gmail.com>
Co-authored-by: Davemaina1 <dmain7015@gmail.com>
Carry forward bounded literal include/includeIf configuration capabilities
and env -S/--split-string words from PRs #2858 and #2897. Charge array
copy and expansion work before allocation to preserve the shared quota.
Verified 731 hook cases and 60 real Git/config and registered-route
controls. Dynamic remainder and original full source PRs remain held.
Co-authored-by: Nguyen Thanh Dat <ntdat812.dev@gmail.com>
Co-authored-by: Davemaina1 <dmain7015@gmail.com>
Treat non-2xx activity responses as feed errors, preserve non-Markdown Copilot agent assets, and apply the reviewed reference escape parity correction with regenerated bindings. Allow the test runner to drain piped output on its existing success or failure exit status. Validate installed workflows and bounded real Node20/24 pipe regressions.
Match the Windows missing volume-serial exception while retaining strict reported-device, inode, ownership, permission, link and snapshot checks. Add loader warning/block and race regression controls with isolated platform metadata injection.
Open with supported no-follow and nonblocking flags before relying on file metadata. Validate descriptor, pathname and rule-directory consistency before and after reading at most64KiB plus one overflow byte. Reject observed replacement, mutation, premature EOF and non-regular files, and close descriptors on every outcome.
Add12 race and I/O regressions. Keep the Hermes uppercase protected-file fixture real on case-sensitive filesystems and verify that the installed guard still permits first-time creation.
Validation: full6688 reported tests across347 files,12 race tests, full80% coverage gates, scoped Hookify coverage, installed Hookify and Hermes workflows, packed artifact lifecycle, lint, signatures and IOC.
- Call patterns now skip a require/import preceded by a dot, with or
without whitespace or optional chaining, so records.require('./label')
and obj?.import('./x') are method calls rather than module loads.
- Replace the one-level dynamic-argument pattern with a balanced-paren
scan over the string-free skeleton, so require(path.join(__dirname,
getName())) and require(a(b(c()))) are reported as dynamic.
Rescanning all 802 repository JavaScript files against the previous head
changes 6 results, each a newly reported dynamic argument nested deeper
than one level (docker eval checks and one test); no specifier or package
result changes. The real registry is unchanged: 35/35 resolved, zero
failures or warnings.
- An extensionless require now tries only the path, .js, .json, and a
directory's index.js/index.json, as Node does; .cjs and .mjs must be
named, so require('./helper') no longer passes on helper.cjs alone.
- Treat `}` as a statement boundary, so a regex after a block is read as
a regex and cannot swallow a later require.
- Decide whether a paren opens a condition from the token before the
keyword, ignoring whitespace, so `obj.\nif(x) / 2` and
`obj?. while(x) / 2` stay method calls followed by division.
- Record which slots came from template literals and skip them for
static `from` and side-effect `import`, which accept only a quoted
string; a tagged template named `from` is no longer an import.
A template passed to import() is still a dependency.
Rescanning all 802 repository JavaScript files against dd14493e changes
no result, and the real registry still reports 35/35 resolved with zero
failures or warnings.
Follow up PR #3187 at 38b8c07f while preserving the original contribution history and all current-main helper bodies. Remove both CI safety-suite exclusions, clean stale imports and the warning glyph, retain shipped test/coverage entrypoints, and keep unknown test totals honest. The tree matches the fully tested 6246-pass/325-file tree; disposable Claude/OpenCode lifecycle passes.
- Track whether each relative specifier arrives through require or
through import()/static import, and resolve the import forms by exact
path. Node's ESM resolver adds no extension and rejects directory
imports even from a CommonJS file, so import('./helper') and
import('./data') no longer pass on helper.js or data/index.json alone.
require keeps the CommonJS extension and index candidates.
- Stop normalizing backslashes in relative specifiers. Linux and macOS
read them as filename characters, so require('./lib\helper.js') now
fails as non-portable-separator instead of resolving to lib/helper.js.
- Record whether each closing paren ends an if/while/for/with condition,
so a `/` right after one starts a regex. A method named `if` and calls
nested inside a condition still read as division.
extractReferences gains an `imports` list. Rescanning all 802 repository
JavaScript files against the previous scanner changes no result, and the
real registry still reports 35/35 resolved with zero failures.
Carry forward PR #3055 at 92f53c4c onto ef648e01, preserving contributor attribution and current main. Focused maintainer fixes reuse shared input ceilings, preserve late root context through outer bootstrap, bound frontmatter before immutable parsing, and assert real oversized input in the limits workflow.
Carry forward the final scoped delta of PR #3119 at 60e82f95. Keep required dependency closure and select only modules reachable from successful requests; refresh the unchanged 293-skill registry binding.
Carry forward PR #3115ef475c79 and 780dfb78 onto current main. Preserve the newer hook-consent transforms during install and repair. Main already includes the source import fix from #3167.
Keep the operation lock while validating bigint file identity and reuse
only snapshots produced by successful trusted static SELECTs. Avoid
reloading and exporting unchanged databases on repeated public reads.
Retain conservative comparison for generic SQL, including RETURNING and
PRAGMA writes, and invalidate reuse after transactions, exports or errors.
Cover cache invalidation, cross-process visibility, Windows device IDs,
reentrant partial writes, lock contention and independent result objects.
Validate 188 focused tests per environment on WSL Node 22.22.3 and native
Windows Node 22.15.0/24.16.0, plus 38 related WSL tests. Paired warm-read
benchmarks show 7.6-18.1x point-query speedup on 160 KiB/1.28 MiB databases.
Handle Windows Node path stats that report dev=0 for the same file whose
open descriptor reports a volume serial. Keep bigint inode checks strict,
retain device comparisons whenever both are known, and leave POSIX strict.
Cover zero-device identity cases, high inode precision, replacement and
file-type safeguards. Verify 164 focused tests each on native Windows
Node 22.15.0 and 24.16.0, plus WSL Ubuntu Node 22.22.3.
Compare the completed snapshot after get/all queries so RETURNING and
prepared PRAGMA writes survive reloads and reopening. Export only after
the outer operation or transaction succeeds; unchanged read snapshots
still avoid disk writes. This adds one export/byte comparison per read
snapshot without relying on SQL parsing or private sql.js APIs.
Add 18 regression cases covering multi-row INSERT/UPDATE/DELETE RETURNING,
standalone and transactional get/all, no-row PRAGMA writes, and rollback.
The unfixed adapter fails 16 of these cases. Strengthen read-only checks.
Validation: 148 focused tests pass on WSL Node 22 and Windows Node 24;
the general state-store suite passes 20/20 on WSL and 19/20 on Windows,
where the existing file-symlink fixture is denied by Windows permissions.
Scoped adapter coverage is 90.13% lines, 82.73% branches, 100% functions.
ESLint, Unicode safety, and git diff --check pass.
LANGUAGE_RULES had no entry for Dart, and FRAMEWORK_RULES had no way to
detect Flutter, so any Flutter app (pubspec.yaml, lib/*.dart, android/,
ios/) was reported as primary: "unknown" by the SessionStart project-type
banner, despite ECC shipping a dart-flutter-patterns skill and a
dart-build-resolver agent for this exact stack.
Adds a 'dart' language rule (pubspec.yaml/pubspec.lock markers, .dart
extension) and a 'flutter' framework rule that checks pubspec.yaml for
the standard `flutter: / sdk: flutter` dependency shape, via a new
customCheck hook on FRAMEWORK_RULES entries. This distinguishes Flutter
apps from plain Dart packages, which don't depend on the Flutter SDK.
Closes#3469
Add Arabic (ar) localization guide and glossary, register the locale:ar component and docs-ar module across install manifests, and wire test coverage.
Contributed-by: @taljeri (taljeri)
Signed-off-by: taljeri <318237806+taljeri@users.noreply.github.com>
The catalog gate validated only the first README project-tree block and
had no skills/commands counterpart to the agents pattern, so:
- README.md project tree (skills) and (commands) were never checked.
- A stale count in a second tree block was invisible because the agents
pattern used String.match with a non-global regex, which reads only the
first occurrence.
Both are now fail-closed. parseReadmeExpectations walks every tree block
for all three categories via matchAll, reports the offending line number
in the source label, and throws when an entry is missing entirely rather
than skipping it. syncEnglishReadme uses replaceAllOrThrow so --write
repairs every block instead of only the first; replaceOrThrow could not
be reused because it replaces only the first match and its regex.test()
probe is unsafe once the pattern carries the g flag.
README.md:847 documented 67 agents against an actual 68 and was never
checked, so it was corrected.
Fixtures in tests/ci/catalog.test.js and tests/ci/validators.test.js now
emit the skills and commands tree lines the gate requires, and both gain
regression coverage that fails against the previous parser (5 new tests).
main resolves SQL clients behind env -S and its launcher grammars, but a
destructive statement still passed under four forms:
- a shell -c inside a short-option cluster (bash -lc, sh -ec), since only
an exact -c was looked up;
- su, whose -c / --command / -lc value runs through the target user's
shell, before or after --;
- taskset, whose mask or CPU list precedes the command, like timeout's
duration;
- a command nested past the shell -c recursion limit, which was allowed
instead of denied.
The first three are checked like sh -c; past the limit the check now
fails closed.
Keep both the new Polski locale and Bengali in every language switcher,
locale list and alias map; cross-link docs/pl and docs/bn. Resync catalog
counts (69 agents, 294 skills) and the skill-trigger registry digest.
Co-Authored-By: Kishor Morol <kishormorol@gmail.com>
haelyra