From 3af3bfe0a6929fd9c69d8d45c977a695722a87c7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 6 Jul 2026 12:19:56 +0000 Subject: [PATCH] chore: version packages --- .changeset/cli-audit-fix-regression-specs.md | 5 -- .changeset/cli-fatal-path-errors-on-stderr.md | 9 --- ...cli-fixture-skill-layout-and-debinarize.md | 5 -- .../cli-name-mismatch-collision-tiers.md | 9 --- .changeset/cli-ruler-audit-cleanup.md | 5 -- .changeset/cli-ruler-audit-spec-sync.md | 6 -- .../frontmatter-absent-block-validation.md | 9 --- .../frontmatter-diagnostics-silent-loss.md | 9 --- .../frontmatter-early-close-and-bom-blank.md | 9 --- .changeset/live-preferences-project-local.md | 10 ---- ...ty-audit-redos-ansi-symlink-containment.md | 9 --- ...frontmatter-diagnostics-and-core-schema.md | 5 -- .../spec-name-mismatch-collision-tiers.md | 5 -- .../spec-scan-follow-external-symlinks.md | 5 -- ...pec-update-check-hook-boot-not-shutdown.md | 5 -- .changeset/ui-app-ruler-review-fixes.md | 5 -- CHANGELOG.md | 31 ++++++++++ spec/CHANGELOG.md | 22 +++++++ spec/index.json | 4 +- spec/package.json | 2 +- src/CHANGELOG.md | 58 +++++++++++++++++++ src/package.json | 2 +- ui/src/data/user-changelog.json | 50 ++++++++++++++++ 23 files changed, 165 insertions(+), 114 deletions(-) delete mode 100644 .changeset/cli-audit-fix-regression-specs.md delete mode 100644 .changeset/cli-fatal-path-errors-on-stderr.md delete mode 100644 .changeset/cli-fixture-skill-layout-and-debinarize.md delete mode 100644 .changeset/cli-name-mismatch-collision-tiers.md delete mode 100644 .changeset/cli-ruler-audit-cleanup.md delete mode 100644 .changeset/cli-ruler-audit-spec-sync.md delete mode 100644 .changeset/frontmatter-absent-block-validation.md delete mode 100644 .changeset/frontmatter-diagnostics-silent-loss.md delete mode 100644 .changeset/frontmatter-early-close-and-bom-blank.md delete mode 100644 .changeset/live-preferences-project-local.md delete mode 100644 .changeset/security-audit-redos-ansi-symlink-containment.md delete mode 100644 .changeset/spec-frontmatter-diagnostics-and-core-schema.md delete mode 100644 .changeset/spec-name-mismatch-collision-tiers.md delete mode 100644 .changeset/spec-scan-follow-external-symlinks.md delete mode 100644 .changeset/spec-update-check-hook-boot-not-shutdown.md delete mode 100644 .changeset/ui-app-ruler-review-fixes.md diff --git a/.changeset/cli-audit-fix-regression-specs.md b/.changeset/cli-audit-fix-regression-specs.md deleted file mode 100644 index 19473946..00000000 --- a/.changeset/cli-audit-fix-regression-specs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/cli": patch ---- - -Added regression specs pinning two audit fixes: fatal-path errors keep landing on stderr under `--json` / `-q` (stdout stays clean for the JSON contract), and the `-v` verbose logger writes to the Clipanion context stderr instead of `process.stderr`. Test-only, no runtime change. diff --git a/.changeset/cli-fatal-path-errors-on-stderr.md b/.changeset/cli-fatal-path-errors-on-stderr.md deleted file mode 100644 index c9d74bea..00000000 --- a/.changeset/cli-fatal-path-errors-on-stderr.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@skill-map/cli": patch ---- - -Fatal command failures now emit their error text via `printer.error()` (stderr) instead of `printer.info()`, so `--json` / `--quiet` runs no longer exit non-zero with no explanation (44 sites across 9 commands); the `core/update-check` hook receives the update probe injected through the `boot` event payload instead of importing it from `cli/`, and two new lint guards block regressions on both fronts. - -## User-facing - -**Failed commands now always say why.** When an `sm` command fails, the error message is printed even with `--json` or `--quiet`; previously some failure paths exited with a non-zero code and no explanation. diff --git a/.changeset/cli-fixture-skill-layout-and-debinarize.md b/.changeset/cli-fixture-skill-layout-and-debinarize.md deleted file mode 100644 index dec26b4a..00000000 --- a/.changeset/cli-fixture-skill-layout-and-debinarize.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/cli": patch ---- - -The minimal-claude conformance fixture moves its skill from the flat `.claude/skills/hello.md` (which classified as `markdown`) to the directory layout `.claude/skills/hello/SKILL.md`, so the basic-scan case exercises one node per kind as intended; alongside, raw control bytes embedded in the frontmatter-yaml and toml parsers and in safe-text were replaced with escape text, with identical compiled patterns and no behavior change. diff --git a/.changeset/cli-name-mismatch-collision-tiers.md b/.changeset/cli-name-mismatch-collision-tiers.md deleted file mode 100644 index 65eeaa3c..00000000 --- a/.changeset/cli-name-mismatch-collision-tiers.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@skill-map/cli": minor ---- - -New built-in analyzer `core/name-mismatch` flags nodes whose declared `frontmatter.name` diverges from their filename/dirname handle: warn for open-standard skills (the spec requires name == dirname), info where the vendor documents the override as legal. `core/name-collision` gains a warn tier for a declared name colliding with another node's file-derived handle; declared-vs-declared stays error and plain markdown stays out of the collision index. - -## User-facing - -Scans now flag naming drift: a skill whose folder name differs from its name field gets a warning, and an agent or command whose name shadows another file's name is flagged too, so references stop pointing at the wrong file silently. diff --git a/.changeset/cli-ruler-audit-cleanup.md b/.changeset/cli-ruler-audit-cleanup.md deleted file mode 100644 index b00d822c..00000000 --- a/.changeset/cli-ruler-audit-cleanup.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/cli": patch ---- - -Internal cleanup from a cli-ruler compliance pass: built-in plugin string catalogs renamed from `text.ts` to `.texts.ts` so the em-dash lint gate covers them, the frontmatter-yaml and toml parsers share one parse-error sanitiser (the TOML side now also strips DEL bytes), dead legacy metadata projectors dropped from node-build, the activity templates interpolate the shared `.skill-map` path constants, and the BOM heuristic's key-line probe is bounded to 4 KB. diff --git a/.changeset/cli-ruler-audit-spec-sync.md b/.changeset/cli-ruler-audit-spec-sync.md deleted file mode 100644 index 14985d0a..00000000 --- a/.changeset/cli-ruler-audit-spec-sync.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@skill-map/spec': patch -'@skill-map/cli': patch ---- - -Closes the remaining cli-ruler audit findings: the REST contract table in cli-contract.md now documents the implemented preferences, project-preferences, project-ignore, favorites, and update-status endpoints, and architecture.md enumerates all eight PROJECT_LOCAL_ONLY_KEYS members. On the src side, published package metadata and the Claude provider schema descriptions drop their em dashes, and a stale $HOME docstring now points at the closed caller list. diff --git a/.changeset/frontmatter-absent-block-validation.md b/.changeset/frontmatter-absent-block-validation.md deleted file mode 100644 index 6d21acfa..00000000 --- a/.changeset/frontmatter-absent-block-validation.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@skill-map/cli": minor ---- - -Scans now validate an ABSENT frontmatter block against the kind's schema: a claude/codex agent or open-standard skill with no frontmatter at all (or with its fence pushed off the first byte by preceding prose) gets the same `frontmatter-invalid` warning a partial block already got, while all-optional kinds (plain markdown, claude command/skill) validate the empty block clean and stay silent. Malformed-fence heuristics keep precedence, one issue per defect. - -## User-facing - -**Missing frontmatter is now flagged.** An agent or skill file with no frontmatter at all gets the same warning as one with incomplete frontmatter, including when stray text before the `---` fence made the metadata parse as body. Files that need no metadata stay quiet. diff --git a/.changeset/frontmatter-diagnostics-silent-loss.md b/.changeset/frontmatter-diagnostics-silent-loss.md deleted file mode 100644 index 66972a64..00000000 --- a/.changeset/frontmatter-diagnostics-silent-loss.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@skill-map/cli": minor ---- - -Frontmatter diagnostics close three silent-loss gaps: a blank line before the opening `---` fence now warns via `frontmatter-malformed`, a declared-but-empty block now runs per-kind validation, and an unquoted `:` in a value gets an actionable quoting hint; a parse error no longer also reports present-but-unparseable fields as missing. - -## User-facing - -Frontmatter mistakes now get clearer feedback: a blank line before the opening ---, an empty frontmatter block, or an unquoted colon in a value are flagged with hints that say how to fix them, instead of losing your metadata silently. diff --git a/.changeset/frontmatter-early-close-and-bom-blank.md b/.changeset/frontmatter-early-close-and-bom-blank.md deleted file mode 100644 index 7a9d7b8c..00000000 --- a/.changeset/frontmatter-early-close-and-bom-blank.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@skill-map/cli": minor ---- - -Frontmatter diagnostics now detect a metadata block closed early by a stray `---` line inside it: a new `frontmatter-malformed` hint `early-close` names the leaked fields (gated on at least one being a schema-declared property) and suppresses the misleading missing-required report for fields sitting below the stray close; the combined BOM + blank-line accident before the fence now classifies as `byte-order-mark` instead of falling through every heuristic. - -## User-facing - -A stray `---` line inside your frontmatter is now flagged with the fields that were silently falling out of the block, and a byte-order mark plus a blank line before the frontmatter is called out too, instead of the metadata quietly disappearing. diff --git a/.changeset/live-preferences-project-local.md b/.changeset/live-preferences-project-local.md deleted file mode 100644 index b0620173..00000000 --- a/.changeset/live-preferences-project-local.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': minor -'@skill-map/cli': minor ---- - -Move the web UI's "Live updates" and "Real-time node activity" preferences from browser localStorage to the project-local config: new `ui.liveUpdates` / `ui.realtimeActivity` keys in `project-config.schema.json` (project-local only, stripped from the committed layer), read and written through `GET/PATCH /api/project-preferences` and persisted in `.skill-map/settings.local.json`. The SPA loads them before opening the live socket; the former localStorage keys are simply no longer read. - -## User-facing - -The Live updates and Real-time node activity switches now live in Settings > Project and stick to the project instead of the browser: flip them once and every browser profile on this checkout sees the same choice. diff --git a/.changeset/security-audit-redos-ansi-symlink-containment.md b/.changeset/security-audit-redos-ansi-symlink-containment.md deleted file mode 100644 index ae0be4a0..00000000 --- a/.changeset/security-audit-redos-ansi-symlink-containment.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@skill-map/cli": minor ---- - -Hardened the scan pipeline per a cli-hacker audit: rewrote the HTML-tag stripper and capped the inline-code opener in `strip-code-blocks` to linear time (they could hang `sm scan`/`sm watch`), routed disk-sourced `sm config get`/`list` output through `sanitizeForTerminal` (now also dropping a bare CR), validated the activity `serve.json` port, and made the walker skip symlinks whose target escapes the scan roots by default, with a new `scan.followExternalSymlinks` opt-in gated by `--yes`. - -## User-facing - -**Scans stay inside your project.** Symlinks pointing outside it are no longer followed (security fix); re-enable via the Follow external symlinks setting (Settings → Project) or `sm config set scan.followExternalSymlinks true --yes`. Config values are sanitized before printing. diff --git a/.changeset/spec-frontmatter-diagnostics-and-core-schema.md b/.changeset/spec-frontmatter-diagnostics-and-core-schema.md deleted file mode 100644 index fdb6ce7f..00000000 --- a/.changeset/spec-frontmatter-diagnostics-and-core-schema.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/spec": minor ---- - -architecture.md gains §Kernel check · frontmatter diagnostics, the normative backing for the kernel-stamped vocabulary (`frontmatter-parse-error`, `frontmatter-malformed` with its five-hint set including `early-close`, and `frontmatter-invalid` covering absent blocks) and the one-lane-per-node routing; the sidecar identity contract's canonical YAML recipe now names js-yaml 5's `schema: CORE_SCHEMA`, the byte-identical successor of the retired `noCompatMode: true`. diff --git a/.changeset/spec-name-mismatch-collision-tiers.md b/.changeset/spec-name-mismatch-collision-tiers.md deleted file mode 100644 index e17782f5..00000000 --- a/.changeset/spec-name-mismatch-collision-tiers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/spec": minor ---- - -architecture.md §Provider · kind identifiers now specifies the per-kind `identifierMismatch` knob and the `core/name-mismatch` contract: a node whose normalised `frontmatter.name` diverges from its filename/dirname handle is flagged with the kind's declared severity (warn for the open-standard skill kind, info for documented-legal overrides). It also defines the two-tier `core/name-collision` verdict: error for two declared names, warn for declared-vs-file-derived shadowing. diff --git a/.changeset/spec-scan-follow-external-symlinks.md b/.changeset/spec-scan-follow-external-symlinks.md deleted file mode 100644 index f627869b..00000000 --- a/.changeset/spec-scan-follow-external-symlinks.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/spec": minor ---- - -cli-contract.md now specifies that `sm scan`/`sm watch` contain the scan to the project by default: a symlink whose real target escapes the scan roots is skipped rather than followed, defeating a committed hostile symlink that reads arbitrary local files. A new project-local-only `scan.followExternalSymlinks` boolean (default false) in project-config.schema.json opts back in. diff --git a/.changeset/spec-update-check-hook-boot-not-shutdown.md b/.changeset/spec-update-check-hook-boot-not-shutdown.md deleted file mode 100644 index 868b9756..00000000 --- a/.changeset/spec-update-check-hook-boot-not-shutdown.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/spec": patch ---- - -architecture.md corrected two stale statements saying the `core/update-check` hook subscribes to `shutdown`; it subscribes to `boot` (the lifecycle-event table's `boot` row already said so), and the update banner renders above the verb's output. diff --git a/.changeset/ui-app-ruler-review-fixes.md b/.changeset/ui-app-ruler-review-fixes.md deleted file mode 100644 index 9c7c0390..00000000 --- a/.changeset/ui-app-ruler-review-fixes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@skill-map/cli": patch ---- - -Resolved the app-ruler UI audit findings: migrated the files-tree row animation from the deprecated @angular/animations DSL to the native animate.enter/animate.leave CSS API (dropping the @angular/animations dependency), hardened UI service signals to read-only exposure, and consolidated the duplicated frame-scheduling and panel-resize helpers into shared modules. diff --git a/CHANGELOG.md b/CHANGELOG.md index 92e8b439..5e13a4d6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,37 @@ > Forward-looking plan: [`ROADMAP.md`](./ROADMAP.md).
+0.83.0 · 2026-07-06 + +### CLI Minor +- New built-in analyzer `core/name-mismatch` flags nodes whose declared `frontmatter.name` diverges from their filename/dirname handle: warn for open-standard skills (the spec requires name == dirname), info where the vendor documents the override as legal. `core/name-collision` gains a warn tier for a declared name colliding with another node's file-derived handle; declared-vs-declared stays error and plain markdown stays out of the collision index. +- Scans now validate an ABSENT frontmatter block against the kind's schema: a claude/codex agent or open-standard skill with no frontmatter at all (or with its fence pushed off the first byte by preceding prose) gets the same `frontmatter-invalid` warning a partial block already got, while all-optional kinds (plain markdown, claude command/skill) validate the empty block clean and stay silent. Malformed-fence heuristics keep precedence, one issue per defect. +- Frontmatter diagnostics close three silent-loss gaps: a blank line before the opening `---` fence now warns via `frontmatter-malformed`, a declared-but-empty block now runs per-kind validation, and an unquoted `:` in a value gets an actionable quoting hint; a parse error no longer also reports present-but-unparseable fields as missing. +- Frontmatter diagnostics now detect a metadata block closed early by a stray `---` line inside it: a new `frontmatter-malformed` hint `early-close` names the leaked fields (gated on at least one being a schema-declared property) and suppresses the misleading missing-required report for fields sitting below the stray close; the combined BOM + blank-line accident before the fence now classifies as `byte-order-mark` instead of falling through every heuristic. +- Move the web UI's "Live updates" and "Real-time node activity" preferences from browser localStorage to the project-local config: new `ui.liveUpdates` / `ui.realtimeActivity` keys in `project-config.schema.json` (project-local only, stripped from the committed layer), read and written through `GET/PATCH /api/project-preferences` and persisted in `.skill-map/settings.local.json`. The SPA loads them before opening the live socket; the former localStorage keys are simply no longer read. +- Hardened the scan pipeline per a cli-hacker audit: rewrote the HTML-tag stripper and capped the inline-code opener in `strip-code-blocks` to linear time (they could hang `sm scan`/`sm watch`), routed disk-sourced `sm config get`/`list` output through `sanitizeForTerminal` (now also dropping a bare CR), validated the activity `serve.json` port, and made the walker skip symlinks whose target escapes the scan roots by default, with a new `scan.followExternalSymlinks` opt-in gated by `--yes`. + +### CLI Patch +- Added regression specs pinning two audit fixes: fatal-path errors keep landing on stderr under `--json` / `-q` (stdout stays clean for the JSON contract), and the `-v` verbose logger writes to the Clipanion context stderr instead of `process.stderr`. Test-only, no runtime change. +- Fatal command failures now emit their error text via `printer.error()` (stderr) instead of `printer.info()`, so `--json` / `--quiet` runs no longer exit non-zero with no explanation (44 sites across 9 commands); the `core/update-check` hook receives the update probe injected through the `boot` event payload instead of importing it from `cli/`, and two new lint guards block regressions on both fronts. +- The minimal-claude conformance fixture moves its skill from the flat `.claude/skills/hello.md` (which classified as `markdown`) to the directory layout `.claude/skills/hello/SKILL.md`, so the basic-scan case exercises one node per kind as intended; alongside, raw control bytes embedded in the frontmatter-yaml and toml parsers and in safe-text were replaced with escape text, with identical compiled patterns and no behavior change. +- Internal cleanup from a cli-ruler compliance pass: built-in plugin string catalogs renamed from `text.ts` to `.texts.ts` so the em-dash lint gate covers them, the frontmatter-yaml and toml parsers share one parse-error sanitiser (the TOML side now also strips DEL bytes), dead legacy metadata projectors dropped from node-build, the activity templates interpolate the shared `.skill-map` path constants, and the BOM heuristic's key-line probe is bounded to 4 KB. +- Closes the remaining cli-ruler audit findings: the REST contract table in cli-contract.md now documents the implemented preferences, project-preferences, project-ignore, favorites, and update-status endpoints, and architecture.md enumerates all eight PROJECT_LOCAL_ONLY_KEYS members. On the src side, published package metadata and the Claude provider schema descriptions drop their em dashes, and a stale $HOME docstring now points at the closed caller list. +- Resolved the app-ruler UI audit findings: migrated the files-tree row animation from the deprecated @angular/animations DSL to the native animate.enter/animate.leave CSS API (dropping the @angular/animations dependency), hardened UI service signals to read-only exposure, and consolidated the duplicated frame-scheduling and panel-resize helpers into shared modules. + +### Spec Minor (0.75.0) +- Move the web UI's "Live updates" and "Real-time node activity" preferences from browser localStorage to the project-local config: new `ui.liveUpdates` / `ui.realtimeActivity` keys in `project-config.schema.json` (project-local only, stripped from the committed layer), read and written through `GET/PATCH /api/project-preferences` and persisted in `.skill-map/settings.local.json`. The SPA loads them before opening the live socket; the former localStorage keys are simply no longer read. +- architecture.md gains §Kernel check · frontmatter diagnostics, the normative backing for the kernel-stamped vocabulary (`frontmatter-parse-error`, `frontmatter-malformed` with its five-hint set including `early-close`, and `frontmatter-invalid` covering absent blocks) and the one-lane-per-node routing; the sidecar identity contract's canonical YAML recipe now names js-yaml 5's `schema: CORE_SCHEMA`, the byte-identical successor of the retired `noCompatMode: true`. +- architecture.md §Provider · kind identifiers now specifies the per-kind `identifierMismatch` knob and the `core/name-mismatch` contract: a node whose normalised `frontmatter.name` diverges from its filename/dirname handle is flagged with the kind's declared severity (warn for the open-standard skill kind, info for documented-legal overrides). It also defines the two-tier `core/name-collision` verdict: error for two declared names, warn for declared-vs-file-derived shadowing. +- cli-contract.md now specifies that `sm scan`/`sm watch` contain the scan to the project by default: a symlink whose real target escapes the scan roots is skipped rather than followed, defeating a committed hostile symlink that reads arbitrary local files. A new project-local-only `scan.followExternalSymlinks` boolean (default false) in project-config.schema.json opts back in. + +### Spec Patch (0.75.0) +- Closes the remaining cli-ruler audit findings: the REST contract table in cli-contract.md now documents the implemented preferences, project-preferences, project-ignore, favorites, and update-status endpoints, and architecture.md enumerates all eight PROJECT_LOCAL_ONLY_KEYS members. On the src side, published package metadata and the Claude provider schema descriptions drop their em dashes, and a stale $HOME docstring now points at the closed caller list. +- architecture.md corrected two stale statements saying the `core/update-check` hook subscribes to `shutdown`; it subscribes to `boot` (the lifecycle-event table's `boot` row already said so), and the update banner renders above the verb's output. + +
+ +
0.82.0 · 2026-07-05 ### CLI Minor diff --git a/spec/CHANGELOG.md b/spec/CHANGELOG.md index 65309182..09f6447c 100644 --- a/spec/CHANGELOG.md +++ b/spec/CHANGELOG.md @@ -1,5 +1,27 @@ # Spec changelog +## 0.75.0 + +### Minor Changes + +- Move the web UI's "Live updates" and "Real-time node activity" preferences from browser localStorage to the project-local config: new `ui.liveUpdates` / `ui.realtimeActivity` keys in `project-config.schema.json` (project-local only, stripped from the committed layer), read and written through `GET/PATCH /api/project-preferences` and persisted in `.skill-map/settings.local.json`. The SPA loads them before opening the live socket; the former localStorage keys are simply no longer read. + + ## User-facing + + The Live updates and Real-time node activity switches now live in Settings > Project and stick to the project instead of the browser: flip them once and every browser profile on this checkout sees the same choice. + +- architecture.md gains §Kernel check · frontmatter diagnostics, the normative backing for the kernel-stamped vocabulary (`frontmatter-parse-error`, `frontmatter-malformed` with its five-hint set including `early-close`, and `frontmatter-invalid` covering absent blocks) and the one-lane-per-node routing; the sidecar identity contract's canonical YAML recipe now names js-yaml 5's `schema: CORE_SCHEMA`, the byte-identical successor of the retired `noCompatMode: true`. + +- architecture.md §Provider · kind identifiers now specifies the per-kind `identifierMismatch` knob and the `core/name-mismatch` contract: a node whose normalised `frontmatter.name` diverges from its filename/dirname handle is flagged with the kind's declared severity (warn for the open-standard skill kind, info for documented-legal overrides). It also defines the two-tier `core/name-collision` verdict: error for two declared names, warn for declared-vs-file-derived shadowing. + +- cli-contract.md now specifies that `sm scan`/`sm watch` contain the scan to the project by default: a symlink whose real target escapes the scan roots is skipped rather than followed, defeating a committed hostile symlink that reads arbitrary local files. A new project-local-only `scan.followExternalSymlinks` boolean (default false) in project-config.schema.json opts back in. + +### Patch Changes + +- Closes the remaining cli-ruler audit findings: the REST contract table in cli-contract.md now documents the implemented preferences, project-preferences, project-ignore, favorites, and update-status endpoints, and architecture.md enumerates all eight PROJECT_LOCAL_ONLY_KEYS members. On the src side, published package metadata and the Claude provider schema descriptions drop their em dashes, and a stale $HOME docstring now points at the closed caller list. + +- architecture.md corrected two stale statements saying the `core/update-check` hook subscribes to `shutdown`; it subscribes to `boot` (the lifecycle-event table's `boot` row already said so), and the update banner renders above the verb's output. + ## 0.74.0 ### Minor Changes diff --git a/spec/index.json b/spec/index.json index 4f564e82..4c30470f 100644 --- a/spec/index.json +++ b/spec/index.json @@ -178,11 +178,11 @@ } ] }, - "specPackageVersion": "0.74.0", + "specPackageVersion": "0.75.0", "integrity": { "algorithm": "sha256", "files": { - "CHANGELOG.md": "7feb8d5be47e73a09a5ed8291d9f856bd42ec136f85a589d051fa5a5ed6abeb0", + "CHANGELOG.md": "26d979bbadda6f1fb9c6752098efd07a0daf0a5d84fa1bebac0ad0dbbe0f1647", "README.md": "a790cd010b46d47883d1f37e3893cea9d7aa69ec4750c0202e6a0c99991e7980", "architecture.md": "97a8b346f10a2057ad251b31ad68ee795a7daa29f7f09599d69e7e65e9e3e464", "cli-contract.md": "6f7ae07b914f1a24505d80b48a4de2d717ba27c975182fe04ab05e698cc3d67c", diff --git a/spec/package.json b/spec/package.json index ead2ffe2..3c74e60d 100644 --- a/spec/package.json +++ b/spec/package.json @@ -1,6 +1,6 @@ { "name": "@skill-map/spec", - "version": "0.74.0", + "version": "0.75.0", "description": "JSON Schemas, prose contracts, and conformance suite for the skill-map specification.", "license": "MIT", "type": "module", diff --git a/src/CHANGELOG.md b/src/CHANGELOG.md index 5d846d00..0dd11482 100644 --- a/src/CHANGELOG.md +++ b/src/CHANGELOG.md @@ -1,5 +1,63 @@ # skill-map +## 0.83.0 + +### Minor Changes + +- New built-in analyzer `core/name-mismatch` flags nodes whose declared `frontmatter.name` diverges from their filename/dirname handle: warn for open-standard skills (the spec requires name == dirname), info where the vendor documents the override as legal. `core/name-collision` gains a warn tier for a declared name colliding with another node's file-derived handle; declared-vs-declared stays error and plain markdown stays out of the collision index. + + ## User-facing + + Scans now flag naming drift: a skill whose folder name differs from its name field gets a warning, and an agent or command whose name shadows another file's name is flagged too, so references stop pointing at the wrong file silently. + +- Scans now validate an ABSENT frontmatter block against the kind's schema: a claude/codex agent or open-standard skill with no frontmatter at all (or with its fence pushed off the first byte by preceding prose) gets the same `frontmatter-invalid` warning a partial block already got, while all-optional kinds (plain markdown, claude command/skill) validate the empty block clean and stay silent. Malformed-fence heuristics keep precedence, one issue per defect. + + ## User-facing + + **Missing frontmatter is now flagged.** An agent or skill file with no frontmatter at all gets the same warning as one with incomplete frontmatter, including when stray text before the `---` fence made the metadata parse as body. Files that need no metadata stay quiet. + +- Frontmatter diagnostics close three silent-loss gaps: a blank line before the opening `---` fence now warns via `frontmatter-malformed`, a declared-but-empty block now runs per-kind validation, and an unquoted `:` in a value gets an actionable quoting hint; a parse error no longer also reports present-but-unparseable fields as missing. + + ## User-facing + + Frontmatter mistakes now get clearer feedback: a blank line before the opening ---, an empty frontmatter block, or an unquoted colon in a value are flagged with hints that say how to fix them, instead of losing your metadata silently. + +- Frontmatter diagnostics now detect a metadata block closed early by a stray `---` line inside it: a new `frontmatter-malformed` hint `early-close` names the leaked fields (gated on at least one being a schema-declared property) and suppresses the misleading missing-required report for fields sitting below the stray close; the combined BOM + blank-line accident before the fence now classifies as `byte-order-mark` instead of falling through every heuristic. + + ## User-facing + + A stray `---` line inside your frontmatter is now flagged with the fields that were silently falling out of the block, and a byte-order mark plus a blank line before the frontmatter is called out too, instead of the metadata quietly disappearing. + +- Move the web UI's "Live updates" and "Real-time node activity" preferences from browser localStorage to the project-local config: new `ui.liveUpdates` / `ui.realtimeActivity` keys in `project-config.schema.json` (project-local only, stripped from the committed layer), read and written through `GET/PATCH /api/project-preferences` and persisted in `.skill-map/settings.local.json`. The SPA loads them before opening the live socket; the former localStorage keys are simply no longer read. + + ## User-facing + + The Live updates and Real-time node activity switches now live in Settings > Project and stick to the project instead of the browser: flip them once and every browser profile on this checkout sees the same choice. + +- Hardened the scan pipeline per a cli-hacker audit: rewrote the HTML-tag stripper and capped the inline-code opener in `strip-code-blocks` to linear time (they could hang `sm scan`/`sm watch`), routed disk-sourced `sm config get`/`list` output through `sanitizeForTerminal` (now also dropping a bare CR), validated the activity `serve.json` port, and made the walker skip symlinks whose target escapes the scan roots by default, with a new `scan.followExternalSymlinks` opt-in gated by `--yes`. + + ## User-facing + + **Scans stay inside your project.** Symlinks pointing outside it are no longer followed (security fix); re-enable via the Follow external symlinks setting (Settings → Project) or `sm config set scan.followExternalSymlinks true --yes`. Config values are sanitized before printing. + +### Patch Changes + +- Added regression specs pinning two audit fixes: fatal-path errors keep landing on stderr under `--json` / `-q` (stdout stays clean for the JSON contract), and the `-v` verbose logger writes to the Clipanion context stderr instead of `process.stderr`. Test-only, no runtime change. + +- Fatal command failures now emit their error text via `printer.error()` (stderr) instead of `printer.info()`, so `--json` / `--quiet` runs no longer exit non-zero with no explanation (44 sites across 9 commands); the `core/update-check` hook receives the update probe injected through the `boot` event payload instead of importing it from `cli/`, and two new lint guards block regressions on both fronts. + + ## User-facing + + **Failed commands now always say why.** When an `sm` command fails, the error message is printed even with `--json` or `--quiet`; previously some failure paths exited with a non-zero code and no explanation. + +- The minimal-claude conformance fixture moves its skill from the flat `.claude/skills/hello.md` (which classified as `markdown`) to the directory layout `.claude/skills/hello/SKILL.md`, so the basic-scan case exercises one node per kind as intended; alongside, raw control bytes embedded in the frontmatter-yaml and toml parsers and in safe-text were replaced with escape text, with identical compiled patterns and no behavior change. + +- Internal cleanup from a cli-ruler compliance pass: built-in plugin string catalogs renamed from `text.ts` to `.texts.ts` so the em-dash lint gate covers them, the frontmatter-yaml and toml parsers share one parse-error sanitiser (the TOML side now also strips DEL bytes), dead legacy metadata projectors dropped from node-build, the activity templates interpolate the shared `.skill-map` path constants, and the BOM heuristic's key-line probe is bounded to 4 KB. + +- Closes the remaining cli-ruler audit findings: the REST contract table in cli-contract.md now documents the implemented preferences, project-preferences, project-ignore, favorites, and update-status endpoints, and architecture.md enumerates all eight PROJECT_LOCAL_ONLY_KEYS members. On the src side, published package metadata and the Claude provider schema descriptions drop their em dashes, and a stale $HOME docstring now points at the closed caller list. + +- Resolved the app-ruler UI audit findings: migrated the files-tree row animation from the deprecated @angular/animations DSL to the native animate.enter/animate.leave CSS API (dropping the @angular/animations dependency), hardened UI service signals to read-only exposure, and consolidated the duplicated frame-scheduling and panel-resize helpers into shared modules. + ## 0.82.0 ### Minor Changes diff --git a/src/package.json b/src/package.json index f64ee715..e0b7551d 100644 --- a/src/package.json +++ b/src/package.json @@ -1,6 +1,6 @@ { "name": "@skill-map/cli", - "version": "0.82.0", + "version": "0.83.0", "description": "skill-map reference implementation: kernel + CLI + adapters.", "license": "MIT", "type": "module", diff --git a/ui/src/data/user-changelog.json b/ui/src/data/user-changelog.json index f7b56664..1f3c09d1 100644 --- a/ui/src/data/user-changelog.json +++ b/ui/src/data/user-changelog.json @@ -1,6 +1,56 @@ { "schemaVersion": 1, "entries": [ + { + "version": "0.83.0", + "date": "2026-07-06", + "kind": "user-facing", + "highlights": [ + { + "body": "**Failed commands now always say why.** When an `sm` command fails, the error message is printed even with `--json` or `--quiet`; previously some failure paths exited with a non-zero code and no explanation.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "Scans now flag naming drift: a skill whose folder name differs from its name field gets a warning, and an agent or command whose name shadows another file's name is flagged too, so references stop pointing at the wrong file silently.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "**Missing frontmatter is now flagged.** An agent or skill file with no frontmatter at all gets the same warning as one with incomplete frontmatter, including when stray text before the `---` fence made the metadata parse as body. Files that need no metadata stay quiet.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "Frontmatter mistakes now get clearer feedback: a blank line before the opening ---, an empty frontmatter block, or an unquoted colon in a value are flagged with hints that say how to fix them, instead of losing your metadata silently.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "A stray `---` line inside your frontmatter is now flagged with the fields that were silently falling out of the block, and a byte-order mark plus a blank line before the frontmatter is called out too, instead of the metadata quietly disappearing.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "The Live updates and Real-time node activity switches now live in Settings > Project and stick to the project instead of the browser: flip them once and every browser profile on this checkout sees the same choice.", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + }, + { + "body": "**Scans stay inside your project.** Symlinks pointing outside it are no longer followed (security fix); re-enable via the Follow external symlinks setting (Settings → Project) or `sm config set scan.followExternalSymlinks true --yes`. Config values are sanitized before printing.", + "packages": [ + "@skill-map/cli" + ] + } + ] + }, { "version": "0.82.0", "date": "2026-07-05",