everything-claude-code

fix: harden CI validators

Ports personal-path validator hardening and quoted checkout detection onto current main.

Affaan Mustafa · 2026-05-11 03:08:43 -04:00

e674a7dbd7

fix: port hook session and dashboard safety fixes

Ports suggest-compact session_id isolation and dashboard terminal/document launch safety onto current main.

Affaan Mustafa · 2026-05-11 02:53:28 -04:00

1abc3fb381

fix: sync skill frontmatter and catalog counts

Adds missing skill frontmatter, normalizes strict YAML metadata, syncs README catalog counts, and extends catalog validation for README/plugin/marketplace count drift.

Affaan Mustafa · 2026-05-11 02:33:29 -04:00

27508842b1

fix: restore short Claude plugin slug and skill installs (#1712 )

Affaan Mustafa · 2026-05-11 02:10:36 -04:00

8a57679222

fix: bypass GateGuard file gates in subagents (#1710 )

Affaan Mustafa · 2026-05-11 01:51:24 -04:00

7b964402ee

fix(ci): flag SKILL.md frontmatter defects in validate-skills (#1669 )

* fix(ci): flag SKILL.md frontmatter defects in validate-skills

Issue #1663 reported two SKILL.md frontmatter defects (missing `name:`
on skill-stocktake; literal block-scalar `description: |-` on
openclaw-persona-forge) that PR #1664 addresses at the data level.

This change is complementary: it extends `scripts/ci/validate-skills.js`
to catch the same class of defect statically going forward, so the
frontmatter-vs-renderer problems do not silently reappear as new skills
land.

## Checks added
- Frontmatter must declare a `name:` field.
- Frontmatter `description:` must not use a literal block scalar
  (`|` / `|-` / `|+`) — these preserve internal newlines and break
  flat-table renderers keyed off `description`. Folded (`>`) and inline
  strings are accepted.

## Behavior
- Frontmatter findings default to WARN (exit 0) so this PR does not
  break CI while the two known offenders are still on main. Pass
  `--strict` or set `CI_STRICT_SKILLS=1` to promote them to ERROR
  (exit 1). Structural findings (missing / empty SKILL.md) remain
  errors as before.
- Today against main, the validator reports exactly two warnings —
  the same two files called out in #1663 — and exits 0. When #1664
  lands, the validator reports zero warnings, at which point strict
  mode can be enabled in CI.

## Parser notes
- Bespoke frontmatter parser mirrors the style of `validate-agents.js`
  (tolerant of UTF-8 BOM and CRLF; no new npm dependency).
- Block-scalar continuation lines are skipped so keys inside a block
  scalar are not mistaken for top-level keys.
- Hidden directories (`.something/`) under skills/ are now skipped.

## Tests
Adds five focused tests to `tests/ci/validators.test.js`:
- warns when frontmatter is missing `name` (default mode)
- errors when frontmatter is missing `name` (--strict mode)
- warns on literal block-scalar description (|-)
- accepts folded (>) and inline descriptions under --strict
- skips hidden directories under skills/

## Docs
Adds two bullets to the `Skill Checklist` in CONTRIBUTING.md covering
the two rules now surfaced by the validator.

Refs #1663. Complements (does not compete with) #1664.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): harden SKILL.md frontmatter checks after bot review

Address findings from CodeRabbit, Greptile, and cubic on #1669:

- Guard empty or whitespace-only `name:` values. Previously
  `name:    ` silently passed because the presence check only
  tested key-set membership; now inspectFrontmatter captures
  trimmed values and validate flags an explicit 'name is empty'
  WARN/ERROR.
- Broaden block-scalar detection to cover YAML 1.2 indent
  indicators (`|2`, `|-2`, `>2-`) and trailing comments
  (`|-  # note`). The old regex required a bare `|`/`>` with
  optional `+`/`-`, which let valid-but-disallowed forms slip
  through.
- Update CONTRIBUTING.md checklist to list `|+` alongside `|`
  and `|-` for parity with the validator.
- Extend runSkillsValidator to accept env overrides and add four
  regression tests: empty name, |+ description, |-2 + comment, and
  CI_STRICT_SKILLS=1.

* fix(ci): address round-2 review on validate-skills frontmatter

- Tighten extractFrontmatter closing delimiter to require a newline or
  end-of-file after the closing `---`, so body lines beginning with
  `---text` are not parsed as frontmatter (CodeRabbit).
- Strip both trailing and comment-only values in inspectFrontmatter, so
  `name: # todo` is surfaced as empty rather than silently passing
  (cubic P2).
- Extract validateSkillDir helper so the per-directory validation
  block moves out of validateSkills, keeping both functions under the
  50-line guideline (CodeRabbit nit).
- Hoist runSkillsValidator to module scope in the test harness and
  share the spawnSync import with execFileSync so the helper stops
  re-requiring child_process on every invocation (CodeRabbit nit).
- Add regression tests: comment-only `name:` values must fail strict
  mode; `---trailing` body lines must not be parsed as frontmatter.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Update tests/ci/validators.test.js

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

Gaurav Dubey · 2026-05-11 01:14:38 -04:00

e196f8a4cb

fix(hooks): resolve MCP health-check spawn ENOENT on Windows (#1456 )

* fix(hooks): resolve MCP health-check spawn ENOENT on Windows

On Windows, commands like 'npx' are batch files (npx.cmd) that require
shell expansion to resolve via PATH. Without shell: true, Node.js
spawn() fails with ENOENT.

However, absolute paths (e.g. C:\Program Files\nodejs\node.exe) must
NOT use shell mode because cmd.exe misparses paths containing spaces.

Fix: enable shell mode only for non-absolute commands on Windows, using
path.isAbsolute() to distinguish. This matches how attemptReconnect()
already handles the shell option.

Fixes #1455

* fix(hooks): harden Windows shell spawn — validate command for metacharacters

Addresses bot review feedback on PR #1456:

- Add UNSAFE_SHELL_CHARS regex to guard against shell injection when
  needsShell=true: cmd.exe operators (&, |, <, >, ^, %, !, (), ;,
  whitespace) are rejected before shell mode is enabled
- Add typeof command === 'string' check so path.isAbsolute() cannot
  throw on malformed non-string command values
- Rename test to 'via PATH resolution' (not Windows-only; runs all platforms)
- Fix misleading test comment: 'node' resolves via PATH like npx.cmd but
  does not itself use .cmd; comment now accurately reflects the intent

* fix(hooks): kill full process tree on Windows when shell mode is used

When needsShell=true, the spawned child is cmd.exe. Calling child.kill()
only terminates the shell, leaving the real server process orphaned.

Use taskkill /PID <pid> /T /F on Windows+shell to kill the entire
process tree rooted at cmd.exe. Fall back to SIGTERM+SIGKILL on all
other platforms or when shell mode is not active.

* fix(hooks): fall back to child.kill() when taskkill fails

Windows taskkill can fail if it's not on PATH, the process already
exited, or permissions are denied. Previously the failure was silently
ignored and no kill signal reached the child.

Now: capture the spawnSync result and fall back to child.kill('SIGKILL')
on any taskkill error or non-zero status. This still may leak a
detached server process but at least guarantees the cmd.exe shell is
signaled.

Michael · 2026-05-11 01:13:37 -04:00

600072ebd8

fix: handle dotted reserved snapshot names