mirror of
https://github.com/affaan-m/ECC.git
synced 2026-10-17 21:55:34 +02:00
iyashjayesh
51fe0e9163
Addresses the review on #3039. Four findings, all of them real. Skills-first (Greptile P2). AGENTS.md says commands/ exists for compatibility and the direction is skills-first, so the workflow now lives in skills/token-card and commands/token-card.md is a thin shim pointing at it — 70 lines down to 28. Unpinned remote code (CodeRabbit major, Greptile P1, CWE-494). The workflow ran `npx -y @tokenchit/cli@latest` and handed whatever the registry currently serves read access to local session logs. It is pinned to 0.7.0, the skill says to raise the pin knowingly, gives the `npm view … dist.integrity` check, and step 1 is now an explicit confirmation before the first download on a machine. The "no network request" claim was false as written (both bots). `sync` sends nothing, but the npx invocation around it is a registry download, and the sentence read as though the whole step were offline. It now separates the two. `--dry-run` wrote a file (Greptile P2). Step 1 created `.tokenchit.json` via `init` before `sync --dry-run` ran, so a documented no-op mutated the tree. Initialisation is skipped on a dry run and reported as prospective instead. The README offer was unreachable (Greptile P2). "Stop after step 3" sat directly below step 4, so the step that puts the card in the README — the whole point — could never run. The boundary moved to after step 4; publishing still requires being asked for by name. Wiring: agent.yaml skills list, manifests/install-modules.json under operator-workflows (beside cost-tracking and ecc-tools-cost-audit), and package.json `files`, which the npm-publish-surface test requires to track the module graph. `yarn install --mode=update-lockfile` leaves yarn.lock byte identical, so nothing to commit there. docs/tr/AGENTS.md carries two skill counts the catalog sync does not reach, both 286 -> 287. npm test: 4396 passed, 0 failed. markdownlint clean on both files.