v0.1.0-beta.17: chore: release 0.1.0-beta.17 (#367)
Pre-release
Two fixes since v0.1.0-beta.16. A skill you install while the app is open
turns up in the slash menu when you come back to it, and the toolchain that
packaged this build no longer unzips Electron with an abandoned extractor.
The slash menu picks up a skill you installed mid-session
A catalogue discovered once never refreshed for the life of the window. A skill
installed after a chat was opened stayed invisible in that workspace until the
app relaunched — while a workspace created after the install picked it up
immediately, which is exactly what made the older chat look like the install had
simply failed.
staleTime was doing less than it appeared to: it only decides whether a
trigger refetches, and this query had none. The composer's observer stays
mounted for the whole chat, and refetch-on-window-focus is off app-wide, so
nothing ever asked again.
The catalogue now revalidates on the two deliberate triggers — the slash menu
opening, and the app coming back from somewhere else. Discovery spawns a child
process, so each trigger is gated:
- 30 seconds between refreshes, so repeated opens inside one window cost
nothing. - 5 seconds away before a return counts as one, so a native dialog or a
detour into DevTools is not mistaken for a trip to go install something. - 5 minutes after a discovery that failed, because a failure still resolves
and still refreshes the age clock — a machine with noclaudeon it must not
re-spawn a doomed child every time its user turns back to the window.
The refresh lands in the query and never under an open menu: the list the menu
is already showing is held steady rather than reordered beneath the keyboard
highlight, so the next open paints the new one. A skill installed without ever
leaving the window has no trigger to fire, and surfaces on that second open.
The packaging toolchain no longer ships an abandoned extractor
extract-zip@2.0.1 restores symlinks without validating their targets, so an
archive holding ../../../etc/passwd writes outside the directory it is being
extracted into — CVE-2026-56876 / GHSA-jmr9-qjv8-65gv. electron-forge package
unpacks the downloaded Electron bundle with it, reached through
@electron-forge/cli → @electron/packager. The package last published in 2023
and has no patched version, which left it as this repository's only open
Dependabot alert; npm audit fix offered nothing better than a semver-major
downgrade of the DMG maker.
It is now aliased in overrides to @electron-internal/extract-zip — the same
swap Electron made upstream in electron/packager#1917, which lands in Forge 8,
brought forward until that is stable. The replacement is a napi-rs module
carrying prebuilds for every platform inside its tarball, so nothing compiles at
install time, and yauzl, fd-slicer, pend, and @types/yauzl leave the
dependency tree with it.
That also removes the mid-extraction hang that used to make electron-forge package exit 0 with an empty out/ under a newer Node — so the Node 24 pin now
rests only on macos-alias being V8-ABI-bound and on Node 24 being Active LTS.
Requires macOS on Apple silicon. Signed with a Developer ID certificate, run
under the hardened runtime, notarized and stapled — both the .app and the
.dmg carry their own ticket, so Gatekeeper clears them on first open without a
network round-trip.