The release workflow silently skipped every release because auto-version.mjs
imported conventional-recommended-bump which was never in devDependencies.
The error handler treated the import crash as "no bump needed." Now the
dependency is installed and the bump step distinguishes expected skip (exit 1)
from real crashes (any other non-zero exit).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Parameterize the artifact writer to support 5 AI coding tools
(Claude Code, Cursor, GitHub Copilot, Codex CLI, Generic) via
ToolProfile config objects. Add interactive first-run tool selector,
persistent config, orphan detection for tool switching, and
parameterized sentinel markers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Auto-version from conventional commits (auto-version.mjs) with git-diff
gate: only releases when src/ or package.json actually changed
- 5-platform binary builds (linux x64/arm64, macOS x64/arm64, windows)
- npm publish with auth token wiring
- GitHub Release with auto-generated notes and binary attachments
- Smoke tests for package tarball and auto-version script
- Hardened: top-level permissions: {}, env bindings (no expression injection),
persist-credentials only where needed for git push
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Pin GitHub Actions by full SHA to prevent tag-swapping attacks
- Add .npmrc with ignore-scripts and 7-day minimum-release-age quarantine
- Add 30s default request timeout for API calls without caller signal
- Remove unused `open` dependency to reduce attack surface
- Strip OpenAPI source URL from generated types header
- Add SECURITY.md documenting threat model (T1–T8), review history, and
design decisions
- Add persist-credentials: false to checkout action
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Implement client-side Ed25519 signature verification (Phase 5B) to ensure
lesson bundles haven't been tampered with between the API and CLI.
REQUIRE_SIGNATURES is set to true (fail-closed). The ApiResult type now
exposes responseHeaders so fetchLesson can extract X-Bundle-Signature
and X-Bundle-Key-Id headers for verification.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Core student commands plus shared supporting modules:
- lesson-ref parser: m<N>l<N>, module range 1..5 per 10xdevs3 shape
- api-content: typed wrappers for catalog/modules/lesson/health
- writer.ts: phase 4 planning stub; phase 5 swaps in real writes
- format.ts: shared formatReleaseAt (long-form English dates, UTC
day-start snapping so "in N days" never drifts by one at midnight)
10x list accepts both '1' and 'm1' to match '10x get m1l1'. Drill-in
hints always include a concrete runnable example, picked from an
unlocked module when available so the suggested command works today.
10x doctor gains a hint field on every check result. Human report
uses Title-case labels (Auth/API/Config/Version/Claude); JSON keeps
stable lowercase names so machine consumers don't break.
Message style guide at the top of src/lib/output.ts codifies:
- never echo API machine codes ("module_locked", "not_found", ...)
as human copy — build the sentence from payload fields
- error = what happened; hint = runnable '10x ...' command
- timestamps always through formatReleaseAt() on stderr; JSON
consumers still get the raw ISO
- module hints show both accepted input forms so students discover
the alternative
55 new tests, 121 total, all green. typecheck + oxlint clean.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Wrap the auth-guard refresh path in a proper-lockfile lock that re-reads
auth.json inside the critical section, so cooperating CLI processes (and
parallel in-process callers) racing on a near-expiry token can no longer
double-refresh — the late caller observes the rotated token and short-
circuits. Lock policy: 5 retries with 100–1000ms exponential backoff and
a 10s stale threshold, with auth_lock_timeout surfaced as a clean error
envelope on contention.
Add three test suites locking in invariants previously enforced only by
convention:
- auth-guard-concurrency: in-process race, cross-process race via
child_process.fork, stale-lock recovery, contention timeout
- exit-codes: per-command exit-code matrix for auth login/--status
/--logout, including the F1 fix (expired token in JSON mode → exit 3)
- json-envelope: stdout envelope contract + leakage guard catching
stray verbose markers, ANSI escapes, clack glyphs, multi-line output,
and accidental email echo
Share auth-flow and @clack/prompts module mocks via tests/helpers/* so
mock.module registrations don't leak across test files in the same
bun test process; the mocks fall through to the real implementations
when no test state is configured, leaving auth-flow.test.ts untouched.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions[bot]