Skip to content

v0.11.0 — gate hardening, honest CI, i18n catch-up

Latest
Latest

Choose a tag to compare

View all tags
@biznuts biznuts released this 12 Jul 14:43
v0.11.0
5c0721f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adversarial full-project review → three PRs: gate hardening (#10), docs/CI truthfulness (#11), i18n catch-up (#12). Every gate defect was empirically reproduced before fixing and re-verified after. Suite: 92 tests, now run on Linux + Windows × Node 20/24.

Fixed (the gate)

  • Symlink/junction escape in syncPairs paths — a relative path could resolve through a symlink or junction to a file outside the repo (junctions are privilege-free on Windows). Every pair path is now realpath-confined to the repo root's real path; escaping pairs are skipped and the reminder stays byte-identical to the unconfigured one.
  • A corrupt local marker no longer silently disables a team opt-in — a .local.json that fails to parse falls back to the committed team marker beside it; a parsing local marker still overrides (including an enabled: false veto).
  • UTF-8 BOM no longer disables a marker (common with Windows editors) — stripped before JSON.parse.
  • Windows path-case mismatches no longer suppress the gate (x:\ vs X:\) — containment and pair-matching compares case-fold on win32.
  • TOCTOU in the capped read — hash-mode source reads are fd-based (open → fstat → read the stat'd size, ≤ 512 KB), refusing non-regular files.
  • Mode-aware edit-retarget wording — "(and its synced-to marker)" only for hash pairs; reserved modes never retarget. Multi-pair drift lines each carry the [never-stale] prefix.

Added

  • NotebookEdit in the PostToolUse matcher — notebook edits get the same reminder and retargeting as Edit/Write/MultiEdit.
  • 13 regression tests for all of the above, and test/release.test.mjs pinning every version stamp to plugin.json so a bump cannot ship half-done.

Changed

  • CI is honest and broader: ubuntu + windows × Node 20/24 (the win32 junction/case-fold paths are now actually exercised); the marketplace version step no longer passes a vacuous comparison silently.
  • Docs truthfulness sweep: declared/version modes consistently described as deferred — not planned; CONTRIBUTING documents all four test files; stale bare /never-stale references fixed.
  • Translations caught up: all four READMEs (zh-Hant, zh-Hans, ja, ko) gain the full syncPairs section (absent since v0.9.0) plus this release's changes.

Full changelog: v0.10.1...v0.11.0

Assets 2
Loading