Add focused security regression for sdk-cli allowlisting and document
IOC scan + allowlist probe output under .pr/security-evidence-3171.md.
Signed-off-by: Frank_zhu <58329837+Frank-zhu0404@users.noreply.github.com>
New skill to optimize LLM prompt caching hit rate and reduce API costs.
Covers:
- Prompt structure ordering (cacheable first, dynamic last)
- What to cache vs what not to cache
- Provider-specific notes (OpenAI/Anthropic/Google)
- Cost savings calculator
- When caching is NOT worth it
Windows: compare repo identity via normalizeRepoPath/sameRepoIdentity (8.3 short names, case, separators; inode fallback). All nine windows-latest jobs green on 52587005.
skillforge validate reports SF1009 (no license declared) on every skill
in .agents/skills. This adds license: MIT to all 39, matching the
repository LICENSE.
license only. The Codex mirror's frontmatter is governed by an allowlist
in tests/ci/codex-skill-surface.test.js - allowed-tools, description,
license, metadata, name - and license is the one field on it that
skillforge asks for. compatibility is deliberately absent here; widening
that contract is a separate decision about what the Codex surface
supports.
node tests/ci/codex-skill-surface.test.js: 4 passed, 0 failed.
Split out of #2993 so both PRs land under the review-bot file limits.
Co-authored-by: Çağrı Solakoğlu <cagri.solakoglu@vtcenerji.com>
Preserve current main hook-loader and silent-output changes alongside the reviewed optional Polish documentation module. Package delta only adds docs/pl to shipped files.
Source-PR: https://github.com/affaan-m/ECC/pull/3121
Source-Head: 071f2dbd28
The real-PTY test piped answers on fixed sleeps, typing them ahead of
readline. Under CI load the first answer could land before the interface
listened, shifting every later answer onto the wrong question: the
ubuntu-latest Node 18.x npm job installed Claude only, exited 0, and never
printed the Kimi profile prompt while the sibling yarn, pnpm, and bun jobs
on the same Node version passed. Answer each prompt once it appears on
screen instead; spawned stdio goes through cat because the macOS script(1)
refuses a socket stdin.
Use the checkout containing the new locale, document prerequisites, and distinguish preview, docs-only installation, and explicit full hook activation. Preserve contributor locale implementation and current sponsor content.
Source-PR: https://github.com/affaan-m/ECC/pull/3121
Source-Head: 071f2dbd28
Root package.json declared no main or exports, so OpenCode npm plugin
resolution (import.meta.resolve) failed and the plugin was silently
skipped (#3127). The .opencode TypeScript sources imported siblings
with .js specifiers that only exist after compilation, so the home
install, which loads the .ts files in place, crashed the tool registry
with ERR_MODULE_NOT_FOUND (#3112).
Declare main/types/exports on the root package pointing at the
compiled plugin entry, switch the sources to .ts specifiers, and
enable allowImportingTsExtensions with rewriteRelativeImportExtensions
so the emitted dist keeps working .js specifiers. Add smoke tests that
build the package, resolve and import the entry by name from a temp
install, and verify every in-place relative import resolves.
Fixes#3127Fixes#3112
Affaan Mustafa