Close the 0.2.4 tech-debt batch: secret scan, silent drops, orphan-drift, atomic import - #11
Merged
Merged
Conversation
…ing it runCli and the unify golden regen script pointed --import at tsx's internal dist/loader.mjs; a tsx upgrade that moves it would break every CLI test. Resolve tsx's exports["."] from the repository in one shared helper instead.
…r format A 52-letter lowercase run or a run inside a snake_case identifier was flagged as a PAT, while the 84-char format Azure DevOps issues since sprint 241 was not caught at all.
UTF-16 text was taken for binary (NUL bytes) and skipped, or read as UTF-8 mojibake no pattern matches, so a token in it reached the Forge. The decode is for scanning only.
…S.md The emitter's output was only checked with toContain, so a reordered section or an extra blank line passed. Pinning it first proves the warning change that follows emits identical bytes.
…code A steering ingredient with targets "*" reached the claude-code switch and was discarded by a bare break. It is now skipped with a warning; emitted bytes are unchanged.
The emitter filtered down to rules up front, so agents, commands, skills, mcp, scripts, hooks and steering aimed at it vanished without a word. Each is now skipped with a warning; the pinned AGENTS.md bytes are unchanged.
The Targets section now says which ingredients each emitter cannot express, matching the kiro paragraph, plus the EOL/BOM contract AGENTS.md follows.
apply() dropped orphan-drift from the rewritten lock, so the file was reported once and then forgotten. It now keeps the old entry, as drift does, until the user deletes the file; tests cover two syncs and sync --check.
An import that threw partway (a cyclic existing ingredient, a bad .mcp.json) left the ingredients already written orphaned in the Forge. Writes now go to an in-memory overlay and reach disk only after the run is planned; the error says the Forge was left untouched.
Seeds a cyclic existing MCP ingredient so the run fails after a rule was already planned, and checks the Forge bytes, the missing Forge directory and the CLI message. A third case pins that a staged ingredient is compared against exactly as a written one was.
The import row now names the guarantee the importer holds, so users know a failed run needs no cleanup before it is re-run.
The default targets "*" aims a whole profile at agents-md, so one warning per ingredient buried the rest; each line still names every skipped ref.
The import row still claimed UTF-16 files were not scanned, which f120c5f made false.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
craftar@0.2.4to npm after approval in thenpmenvironment._as a boundary, and adds the 84-charAZDOformat.claude-codewarns on a steering ingredient explicitly aimed at it;agents-mdwarns for every non-rule ingredient aimed at it, one line per type naming each skipped ref. AGENTS.md bytes are pinned by exact-bytes, variant and EOL tests written before the emitter change.orphan-driftstays visible: a hand-edited orphan keeps its lock entry until the file is deleted, likedrift.importleaves the Forge untouched and says so. An I/O error during the final flush still lists the paths already written (accepted residual).dist/path.What users will see
claude-code,kirooragents-md.craftar.lockchanges only for a workspace with a file inorphan-drift; theresync --checknow keeps exiting 1 until the file is deleted (before, it passed after one sync).agents-mdwith agents, commands, skills or MCP servers at the defaulttargets: "*"get new warning lines (one per type). Exit codes are unchanged.Test plan
npm run typecheck— passesnpm test(Linux, local) — 19 files passed / 1 skipped; 348 tests passed / 5 skipped.skipIf(win32)tests ran.node-cli-revieweranddocs-author: clean after one correction round (README UTF-16 wording,163a30e)