A relative url() in a content-script stylesheet resolves against the page
origin (the D1 @font-face 404/403 defect, KB #6441) and no amount of
allowlisting catches it - the reference looks valid, it just can never
load. Fail the pack for both targets whenever the css the manifest
registers as content_scripts references a non-absolute url(), driven off
the manifest so new stylesheets are covered automatically.
All three skip/exit outcomes now resolve through main()'s return value and a
single top-level exit, so no process.exit can preempt the cleanup finally
(web-ext tree kill, BiDi close, temp-dir removal). Mutation pass 2/2 on the
guard's key assertions (KB 5489): wrong site host -> indicator FAIL; altered
primer text -> primer FAIL; both reverted, final run 5/5.
The Firefox proof (injection + full-primer send, FF 155) existed only as a
one-off drive and a KB recipe; any edit could silently decay it back into a
claim. scripts/firefox-e2e.mjs rebuilds the Firefox stage, installs it in real
Firefox via web-ext (release-safe temporary add-on) and asserts over a raw
WebDriver BiDi session on the same instance (--args=--remote-debugging-port,
KB #6443) that the indicator injects, a trusted Enter sends the full primer,
and no extension-sourced console errors appear. Skips with exit 0 and a clear
message when Firefox (FIREFOX_BIN override) or web-ext is unavailable, so
test:all never breaks on machines without Firefox. Wired as test:firefox and
added to test:all, mirroring the existing test:browser split (npm test stays
the fast hermetic unit/contract suite).
Three items from the #936 maintainer review:
- gecko id is now a UUID-style id ({2bcb73e7-...}) that claims no domain
(AMO ids are permanent); removed the Co-Authored-By footer from the
Firefox README while touching it.
- the Firefox manifest template no longer carries a version: the firefox
pack target injects the shared version (package.json == Chrome manifest,
validated) at pack time, so the two manifests cannot drift.
- background uses the Firefox MV3 event-page form (background.scripts);
service_worker dropped, strict_min_version 121.0 kept as a conservative
floor with the corrected rationale. The stage verifier now also validates
background.scripts references.
Verification: extension unit suite 11/11 (new firefox-template contract
test), firefox pack + stage verification green, chrome pack unaffected.
The shipped gecko.id pointed at an unowned domain and the background
block declared both service_worker and scripts, which WebExtensions
reject together. Use a stable add-on id, keep a single MV3 service
worker, and derive the packed Firefox version from the shared source so
the two manifests cannot drift at pack time.
`node build-extension-zip.mjs firefox` stages the shared runtime flat
(WebExtensions forbid ../ escapes), swaps in the firefox manifest, and verifies
against the package allowlist -> dist/caveman-browser-firefox-<ver>.zip. The
chrome target is unchanged.
Co-Authored-By: Alot1z <Alot1z@users.noreply.github.com>
Signed-off-by: Alot1z <Alot1z@users.noreply.github.com>
Single-commit port of the Caveman 2 tree onto the original repo history
(candidate caveman-2@88878a4 applied over main@3098342). No unrelated-history
merge; original history untouched.
Preserved v1 surfaces:
- skills/caveman/SKILL.md byte-for-byte, plus plugin mirror and caveman.skill zip
- legacy CI (Node 18/20/22 installer + Python 3.11 suites) alongside engine-ci
- cli/install.js compatibility shim forwarding to bin/install.js
- .codex/config.toml ships both hooks and codex_hooks for older Codex (#617)
- README Trendshift + Skills.sh badges and local star-history asset
- v1.10.0-pinned curl installs; benchmarks/tmp-starcharts ignore rules
Fixed for public same-repo release:
- SECURITY.md vulnerability reporting points at this repository
- release-binaries.yml publishes to this repo via job-scoped GITHUB_TOKEN
(cross-repo PAT removed); binary-release environment still gates signing
- packages/cli/PUBLISHING.md rewritten for packages/ layout and same-repo flow
- profile-contract and provider-catalog lanes skip lane-scope gates on
initial import so the launch PR can gate on their real validation steps
- ANNOUNCEMENT.md network claim corrected: compression is local; requests
still go to the provider you configured
Caveman 2 stays opt-in: bin-v1.0.0 binaries and @caveman-ai/cli publish
separately after this lands and soaks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BLvb5QniwYjmcawyssQNw9
Alot1z