* fix(release): wait for npm metadata before verifying publish
Direct publish-npm verified immediately after npm accepted 1.22.1,
while registry metadata still lacked dist.tarball. Poll until
integrity exists, then keep the strict pack/gitHead compare. When
the version is already on npm and matches the pack from cli_sha,
skip publish and only complete tag/Release.
* chore(release): prepare v1.22.2
---------
Co-authored-by: Claude <noreply@anthropic.com>
Master push enumerated every open PR and failed Prepare version when
the PR had not integrated current master. Classify that as a branch
update, write no record, and continue so unrelated open PRs cannot
turn the trusted writer red.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(skills): guide CLI setup, named downloads and updates
* fix(skills): bound npm inventory checks on cold Windows runners
* fix(skills): align launch guide with 10xCards PRD journey
* fix(tests): make helper checks portable on Windows
* test(helpers): trace Windows npm pack startup
* fix(helpers): allow bounded Windows npm startup time
* fix(helpers): use released lesson-scoped skill filters
Correct setup/guide examples and sync ownership to match CLI 1.21.
Exercise the documented preview/write commands through CAC and the
real partial writer, preserving all three trees and the PRD schema.
Refs: https://github.com/przeprogramowani/10x-cli/pull/41
---------
Co-authored-by: Claude <noreply@anthropic.com>
* docs(10xdevs4-cli-access): record membership gates and bootstrap context (p1)
Add canonical access plan, accepted decisions and supporting context.
Record phase 1 verification, Toolkit revision and remaining evidence gaps.
* docs(10xdevs4-cli-access): record course access gates and scoped review (p2)
Update canonical Progress, change status, evidence and implementation review.
Record Toolkit revisions, inherited typecheck limitation and phase 3 prerequisites.
* docs(10xdevs4-cli-access): persist reviewed revisions and phase 3 boundary
Record final reviewed Toolkit and CLI context revisions.
Persist Progress attribution and unresolved W04/W05/W08 prerequisites.
Keep phases 3–6, phase 7 and Manual criteria open.
* docs(10xdevs4-cli-access): record squash-safe source prerequisite
Record PR #30, verified gates, permanent-pin lessons and the remaining merge dependency.
Keep phase 3 and all manual rollout criteria pending.
* docs(10xdevs4-cli-access): record source prerequisite review
Record independent review of PR #30 and verified CI evidence.
Keep the master pin and delivery phase completion pending.
* docs(10xdevs4-cli-access): distinguish candidate checks from final master pins
Record passing pre-merge v4 checks and defer workflow suspension.
Keep the final v3 maintenance pin dependent on the resulting master SHA.
* feat: prepare v4 course delivery and protected project sync
Capture the reviewed implementation and manual rehearsal for draft PR review. Master source prerequisites, full clean verification and coordinated Windows CI remain open; production rollout is separate.
* fix: keep paid CI evidence private and converge cumulative sync
* docs: record merged source prerequisite and passing clean gate
* fix: preserve generated API type line endings on Windows
---------
Co-authored-by: Claude <noreply@anthropic.com>
- auto-version.mjs: use os.tmpdir() instead of hardcoded /tmp/ for
release-notes.md (Windows has no /tmp)
- binary.test.ts: raise startup budget to 150ms on Windows (CI runners
have slower process spawn overhead)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Auto-version from conventional commits (auto-version.mjs) with git-diff
gate: only releases when src/ or package.json actually changed
- 5-platform binary builds (linux x64/arm64, macOS x64/arm64, windows)
- npm publish with auth token wiring
- GitHub Release with auto-generated notes and binary attachments
- Smoke tests for package tarball and auto-version script
- Hardened: top-level permissions: {}, env bindings (no expression injection),
persist-credentials only where needed for git push
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Pin GitHub Actions by full SHA to prevent tag-swapping attacks
- Add .npmrc with ignore-scripts and 7-day minimum-release-age quarantine
- Add 30s default request timeout for API calls without caller signal
- Remove unused `open` dependency to reduce attack surface
- Strip OpenAPI source URL from generated types header
- Add SECURITY.md documenting threat model (T1–T8), review history, and
design decisions
- Add persist-credentials: false to checkout action
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
przeprogramowani