Repository navigation
v3.1.0: friendlier execution policy and installer profile/allow commands - #5
Merged
Merged
Conversation
…s (v3.1.0) - Standard profile recognizes common validation runners (tsc, vitest, jest, pytest, cargo, go, eslint, ruff, ...) with validating subcommands only, the same JS tools via npx/pnpm exec/bunx when installed locally, and read-only inspection (git status/log/show/blame, ls, cat, grep, rg, find). - Secret detection matches secret files by basename; single-quoted `$` is literal. Paths that merely mention credentials/secrets are no longer blocked. - git log/show/blame run with repository diff helpers disabled. - Blocked results carry policyHint (reason, fix, and an allow command when the profile is the only obstacle). - Installer: interactive profile choice with typed confirmation for unrestricted, --profile flag, `profile` and `allow` commands. - Setup skill interviews the user (provider, profile, extra allows, defaults, clients) before installing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
standardprofile: common validation runners (tsc, vitest, jest, mocha, playwright test, eslint, prettier --check, biome check, pytest, mypy, pyright, ruff check, cargo, go, dotnet, mvn, gradle) with validating subcommands only; the same JS tools vianpx/pnpm exec/bunxonly when installed innode_modules/.bin; read-only inspection (git status|log|show|diff|blame|ls-files|grep, branch listing,ls,cat,head,tail,wc,grep,rg,find).--fix/--write, package installs, Git mutations, and arbitrary scripts stay out..env, keys,*.pem,.npmrc, ...);.env.exampleand paths likecredential-store.test.jsallowed; single-quoted$is literal.git log|showrun with--no-ext-diff --no-textconv,git blamewith--no-textconv.policyHinton blocked results, with anallowCommandwhen only the profile blocks the command.unrestricted),--profile,profileandallow(--list,--remove) commands.Verification
npm test: 376/376 ·npm run test:security: 65/65npm run verify:generated: GENERATED_ASSETS_CURRENTnpm run release:preflight -- --allow-no-tag: RELEASE_PREFLIGHT_PASSED (3.1.0, latest)--profile safe, reinstall preserves it, uninstall clean.