Skip to content

v1.3.0

Choose a tag to compare

View all tags
@Dankosik Dankosik released this 02 Nov 14:10
Immutable release. Only release title and notes can be modified.
v1.3.0
cd31717
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.3.0 — osv-scanner, timeout on macOS, and silent-failure guards

This release comes from what agents actually did in real Claude Code and Codex
sessions: the commands they reached for and lacked, and the habits that made a
failed step look successful.

What changed

  • osv-scanner (#23). One command checks every ecosystem's lockfiles against
    the OSV database: osv-scanner scan source -r .. Agents had been checking
    dependencies by hand with trivy, govulncheck, grype, and raw OSV API queries.
    It is installed from Homebrew, or on Linux from its release binary, verified
    against the GitHub SHA-256 digest like every other tool.
  • timeout on macOS (#23). command not found: timeout appeared in 386
    sessions, rising every month, and agents fell back to perl -e alarm. The
    Brewfile installs GNU coreutils on macOS only. When no timeout is on PATH,
    the installer links ~/.local/bin/timeout to gtimeout; it never replaces an
    existing file. Linux already ships timeout.
  • JSON edits (#23). jq cannot edit in place, so agents rewrote JSON through
    Python. The routing now says yq -i edits JSON too.
  • Silent-failure guards (#24). Two routing lines:
    • Builds and tests piped into tail/head return tail's exit code 0. A
      failing go test ./... 2>&1 | tail -3 && git commit still commits, and the
      failing test's name and message are cut. In real sessions this pipe was
      chained into git commit or git push 49 times. rtk already condenses
      cargo/go/pytest/vitest/tsc output and keeps the real exit code.
    • When the text to replace is missing, a script's str.replace and sd
      change nothing and exit 0. The agent's own edit tool fails instead.
  • verify.sh adds two scenarios: a vulnerable Go pin that only osv-scanner
    catches, and timeout stopping a hung command with exit 124.

The shared routing block is now 544 tokens (o200k).

Install

curl -fsSL https://raw.githubusercontent.com/Dankosik/agent-ready/v1.3.0/bootstrap.sh | AGENT_READY_REF=v1.3.0 bash

Upgrade

Re-run the v1.3.0 command to install the new tools and refresh the managed
instruction blocks, or add --upgrade to also update installed tools.

Notes

  • macOS and Linux; Windows through WSL2.
  • Install commands stay pinned to this immutable tag; moving main URLs are not
    documented.
Assets 3
Loading