Repository navigation
Conversation
…view 2026-11-12)
Template part of the 2026-11-12 CLI family review, so the next CLI made
from the template starts right.
- Adopt cli-base 0.98.0 and cli-testing 0.7.0; move the node-ci and
changelog-guard pins to cli-base v0.98.0 (node-ci was v0.85.1, below
the v0.95.0 coverage re-run fix).
- scripts/sandboxed.ts: lint:commands, smoke:node and smoke:bun run the
built bin with a throwaway HOME and XDG_* folders, no CLIDEV_*
overrides and DBUS_SESSION_BUS_ADDRESS=disabled:. smoke.ts, audit.sh
and live.sh drop or move the same variables for their bin runs
(WC-SECR-24, WC-TEST-3). Template-owned in template.json.
- standards.yml cancels only a pull request's older run, never a run
on main (DEBT-345, WC-CI-7).
- Dependabot groups GitHub Actions updates into one weekly PR; npm was
one group already.
- node-22 and kit-e2e skip their steps on a PR that changes only
Markdown or the version number; the jobs stay, so required checks
pass. No new job (WC-CI-5).
- new's first step and kit/README.md say to turn on
delete-branch-on-merge.
- contracts/mcp-tools.json in cli-testing 0.7.0's short form
(IDEA-288).
- TESTING.md: an upgrade contract uses "previous": {} and seeds with
public commands only (DEBT-338).
- ci:quick builds once.
- The three unreleased "Built on cli-core" fragments are one entry.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…template's scripts scripts/changelog-fragments.ts and scripts/version-level.ts (and their tests) were copies of what cli-base 0.98.0 now ships as `cli-dev changelog fragments` and `cli-dev changelog level`, with the same headings, journal ids and level rules. docs:check, version:check and bin/release call the shared commands, so every CLI made from the template runs one shared path. scripts/changelog-fragments.ts leaves template.json; upgrade lists it in an existing CLI for the owner to delete. scripts/audit.sh stays: `audit --family` installs more CLIs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…h ownCatalogue - cli-core 0.648.0 (review release #2896, #2900); docs/commands.md regenerated (Returns only from a declared output). - src/mcp.test.ts pins contracts/mcp-catalogue.json from cli-core's ownCatalogue: the CLI's own commands an agent finds, read or write. What cli-core mounts is cli-core's to pin, so a new CLI made from the template stops rewriting its catalogue on each cli-core release (IDEA-288, DEBT-331). - A first word never seen as a profile now answers not_found with profile.unknown (FIND-2583): the sign-in test follows it, and a new test keeps session.missing for a profile the config names. - TESTING.md says what the catalogue pin holds; the changelog fragment names 0.648.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…(cli-core 0.648.0) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task
The template part of the 2026-11-12 CLI family review (private report
reports/2026-11-12-cli-family-review.mdincli-private): IDEA-288, DEBT-338, DEBT-345 (CI cancel setting), DEBT-335 (checked), and the family CI items. Every new
CLI starts from this template, so fixing it here keeps the next CLI from repeating the findings.
Why
owner's
HOME,XDG_*and keyring.standards.ymlcancelled a running check on main when the next merge came, leaving that commit unchecked (WC-CI-7).left behind all cost shared Actions time.
What
node-ci.ymlandchangelog-guard.ymlare pinnedto cli-base v0.98.0.
node-ci.ymlwas on v0.85.1, below the coverage re-run fix in v0.95.0.src/mcp.test.tspinscontracts/mcp-catalogue.jsonfromownCatalogue, so only the CLI's owncommands are pinned.
contracts/mcp-tools.jsonis in cli-testing 0.7.0's short form (162 → 78 lines).scripts/sandboxed.ts, template-owned. It gives each run a throwawayHOMEwithXDG_*folders inside it, drops everyCLIDEV_*override and setsDBUS_SESSION_BUS_ADDRESS=disabled:.lint:commands,smoke:nodeandsmoke:bunuse it.smoke.ts,audit.shandlive.shisolate their own binruns the same way.
standards.ymlcancels only a pull request's older run, never a run on main.node-22andkit-e2eskip their steps when a PR changes only Markdown or theversion number. Skipped steps leave the job green, so the required checks pass. node-ci's own jobs are unchanged;
skipping them needs a node-ci input, which is on the cli-base follow-up list.
new's first setup step and inkit/README.md. It is now on for this repository.cli-dev changelog fragmentsandcli-dev changelog levelreplacescripts/changelog-fragments.tsandscripts/version-level.tsindocs:check,version:checkandbin/release."previous": {}, with a seed that uses public commandsonly. The skeleton has no state of its own, so it ships no contract.
profile.unknown: the sign-in test and the kit e2e follow it, and a new test keepssession.missingfor a profile the config names.ci:quickbuilds once. The three unreleased "Built on cli-core" changelog fragments are now one.hostFetchwith the identity'shosts, andcli-dev manifestin a newCLI's
generate. The lint shows noraw-networkorwcat-hostsfinding.Testing
test:coverage(169 tests),test:matrix:check,generate:check,contracts:check,docs:check,standards:check,version:check,security:no-leakandpnpm smoke. The bundle smoke ran underNode and Bun through the sandbox, and so did
lint:commands.kit:e2epassed in full on cli-base 0.98.0 and cli-core 0.647.0. On 0.648.0 both new CLIs passed every step. Theone failing assertion, the sample's unsigned refusal, now expects
profile.unknown. I checked that against thebuilt bin, and CI's
kit-e2eruns the whole check.bash -eo pipefail.audit:commandsand the live check. The live check needs the owner's account.scripts/live.shchanged,so the live record may need a new run before the next template release.
🤖 Generated with Claude Code