Carry forward AbhiramMandala’s canonical TypeScript guidance from PR #3142, reviewed source head 643f61d604. Rebuild current-main counts, Pi projection and trigger digest without replacing existing registry entries.
Use bracket access under the documented noPropertyAccessFromIndexSignature baseline. Type-check and execute the actual fixture, compare published function bodies, and preserve deterministic undefined, sparse-array and concurrency regressions.
Validation: 26 focused checks; strict TypeScript compile; all repository validators; affected ESLint and Markdownlint; deterministic Pi rebuild; real npm pack; disposable Claude, Codex and Copilot install/repair/uninstall with exact skill bytes and preserved user files. Parent independently reviewed the complete staged diff.
Co-authored-by: AbhiramMandala <abhirammandala02@gmail.com>
Add a GitHub issue counterpart to the PR mode of /code-review. The
canonical workflow lives in skills/issue-review and walks nine phases:
fetch the issue with gh, build project context, classify type and
completeness, verify the claim against the code at HEAD, search for
duplicates and prior fixes, assess severity and decision, write a
review artifact with a draft reply, publish only on explicit flags,
and print a one-screen summary.
Issue text is treated as untrusted data: embedded instructions are
never followed, pasted code is never run, and arbitrary links are not
fetched. Writing to GitHub is opt-in via --comment or --label and the
workflow never closes, reopens, or assigns issues.
commands/issue-review.md is the thin slash-command shim. The new
structural test guards the frontmatter, required sections, phase
order, safety invariants, and registration on every surface.
Register the skill and command in package.json, agent.yaml, the
operator-workflows install module, the quick reference, the
command-agent map, and the README; regenerate the command registry
and sync catalog counts to 312 skills and 98 commands.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Tomoya.Fujita <fujita.tomoya@triorb.co.jp>
Claim from the verified payload and matched requirements in the
resource server's onAfterVerify hook, so a forged header can no longer
reserve a legitimate payment's key, and an invalid payment takes no
claim. Fail closed on a store error or timeout by returning an abort
(a throwing hook is skipped and would run the handler unguarded);
document fail-open as an explicit, idempotent-only choice. Cover
Permit2 (BigInt nonce) and keep claims until validBefore/deadline.
The test now drives the real @x402/express middleware with payments
signed by the real @x402/evm client and a stand-in facilitator that
checks EIP-3009 signatures with viem, so verification, the hook, the
handler and settlement run in their real order. Adds exact-pinned,
test-only devDependencies and refreshes the registry digest.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Integrate contributor PRs #3533, #3534, and #3535 on current main. Preserve the read-only module audit, canonical glossary and ADR ownership, and opt-in install closure. Refresh only the manual trigger manifest registry binding and coverage after adding the skill.
The compiled OpenCode tools import `tool` from `@opencode-ai/plugin/tool`
at module top level, and the hooks plugin imports those tools statically.
The package was only a devDependency, so production installs (OpenCode's
npm plugin cache, `npm install --omit=dev`) could not resolve it and the
whole plugin failed to load.
Move it to `dependencies` and add a build-opencode regression test that
fails when the built bundle imports a package not declared as a runtime
dependency.
Fixes#3543
(cherry picked from commit 106024070e)
Preserve full contributor head; refresh catalogs and Pi projection. Verify disposable Claude/Codex installs and resource discovery, with no automatic hooks or governance files.
Preserve full contributor history and current catalog. Actual process workflows cover concurrency, recovery, sprint planning and read-only status. Bound registry symlinks, counts and lock waits; preserve manually curated trigger provenance.
Resolve six conflicts:
- hooks/hooks.metadata.json: keep this branch's gateguard description and
fingerprint, add upstream's hookify-runtime entries.
- package.json: keep both gateguard-report.js and github-coordination.js.
- scripts/hooks/gateguard-fact-force.js, tests/hooks/gateguard-fact-force.test.js,
skills/gateguard/SKILL.md: upstream added a simpler session denial cap; this
branch already has the fuller one (cap threaded through
markCheckedAndCountDenial, malformed-value warning, miss and target notes),
so keep it. Upstream's taskset and su wrapper handling, fail-closed
recursion limit and soft-hyphen sanitising merged cleanly and their tests pass.
- manifests/context-packs/skill-triggers@1.json: take upstream's file and
recompute registryDigest for the merged registry.
Follow up PR #3187 at 38b8c07f while preserving the original contribution history and all current-main helper bodies. Remove both CI safety-suite exclusions, clean stale imports and the warning glyph, retain shipped test/coverage entrypoints, and keep unknown test totals honest. The tree matches the fully tested 6246-pass/325-file tree; disposable Claude/OpenCode lifecycle passes.
Carry forward PR #3049 at 65e6e5ee and repair its missing npm lockfile update. Preserve the exact canonical Yarn lock and confirm the actual OpenCode build/runtime workflow with clean npm installation. Existing audit findings are unchanged from the assigned base.
Three review findings, all verified before fixing.
1. Publish surface (blocking). package.json `files` lists
scripts/gemini-adapt-agents.js but not this script, so the npm tarball
omitted it and ecc-universal users hit MODULE_NOT_FOUND. Added to `files`
and to the allowlist in tests/scripts/npm-publish-surface.test.js, which now
passes 2/2.
2. CRLF agents were silently skipped. The frontmatter regex matched LF only, so
a Windows-saved agent was reported as 'already compatible' while still
carrying tools: Read, Bash and color: teal -- a success message with no
adaptation. Normalize to LF, adapt, then restore the original ending style.
Reproduced before and after: the same CRLF fixture went from 'Updated 0' with
Read/teal intact to 'Updated 1' with read_file/cyan and CRLF preserved.
3. Unknown flags were discarded. Because the script rewrites files in place,
`--dry-run` rewrote every installed agent and exited 0. parseArgs now throws
on any unrecognized option before a directory is selected.
Tests: 12/12 (added CRLF preservation and no-mutation-on-unknown-flag),
gemini-adapt-agents 4/4 unaffected, npm-publish-surface 2/2. Re-run against all
68 canonical definitions: 68 updated, second run 0 updated, no Claude-shaped
frontmatter remaining, no spurious CRLF introduced.
Note: findings 2 and 3 apply equally to scripts/gemini-adapt-agents.js, which
has the same LF-only regex and the same flag filter. Left unchanged here to keep
this PR scoped to the Qwen adapter; worth a follow-up.
Add Arabic (ar) localization guide and glossary, register the locale:ar component and docs-ar module across install manifests, and wire test coverage.
Contributed-by: @taljeri (taljeri)
Signed-off-by: taljeri <318237806+taljeri@users.noreply.github.com>
