2 Commits

• fix: make plugin hooks run on Node 21+ and green the suite under modern Node (#2184)

  ROOT CAUSE: hooks load plugin-hook-bootstrap.js via
  `node -e "...; process.argv.splice(1,0,s); require(s)"`. On Node 21+,
  require.main is `undefined` under --eval, so the `if (require.main === module)`
  guard was false and main() never ran — every plugin hook silently no-op'd
  (e.g. the MCP-health PreToolUse hook stopped blocking). CI (Node 18/20) hid
  this; it only surfaces on Node 21+. Fix: also run main() when require.main is
  undefined (the eval-bootstrap case), while staying dormant on real imports.
  
  Also clears pre-existing main debt the full local suite enforces:
  - catalog:sync — README/docs agent+skill counts drifted after recent merges
  - tests/ci/supply-chain-watch-workflow: update checkout SHA to the merged v6.0.3 (#2183)
  - markdownlint + check-unicode-safety --write across docs/skills
  
  Suite: 2683/2683 green under Node v25; lint + unicode clean.
  
  Co-authored-by: ECC Test <ecc@example.test>

  Affaan Mustafa · 2026-06-07 16:05:28 +08:00
  e755c5f72b
• feat(skills): add laravel-security, laravel-tdd, and php-reviewer agent (#2122)

  * feat(skills): add laravel-security, laravel-tdd, and php-reviewer agent
  
  * fix: resolve code review findings across laravel-security, laravel-tdd, and php-reviewer
  
  - laravel-security: replace env() with config() in runtime code,
    replace wildcard trusted proxies with CIDR ranges, remove blanket
    api/* CSRF exclusion, fix validated() return type, add null-safe
    rate limiter user access, sync mimes/extensions allowlists,
    replace #[Encrypted] with ShouldBeEncrypted, fix RateLimited args
  - laravel-tdd: remove global withoutExceptionHandling() from setUp,
    remove contradictory assertNothingOutgoing(), fix undefined
    variable, replace invalid PHPUnit --min-coverage flag
  - php-reviewer: fix Python contamination, add automated check
    requirement to approval criteria
  
  * fix: align php-reviewer approval criteria and use config dot-notation keys
  
  - agents/php-reviewer.md: sync approval criteria with .txt file version
    (add automated checks requirement for consistency across harnesses)
  - skills/laravel-security/SKILL.md: replace raw env names with proper
    Laravel dot-notation config keys (app.key, services.stripe.*, etc.)
    so config() returns valid values instead of null
  
  * fix: remove unnecessary secret validation for SMTP password

  elmochilyas · 2026-06-07 13:29:12 +08:00
  06c376ae8b