You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A project write (the config, the installer's files) now refuses a link at any folder between the project root and the file. plugin/ moved only for the gold-standard method reference, so this is a PATCH release.
Security
A project write refuses a link at any folder between the project root and the file, wherever it points. Before: a write through an in-project link (an in-project .claude junction or symlink) was made while the hooks refused to read the same file (the 3.23.3 read pin); a link that led outside the project was already refused. Now writeRepoFile and the pre-checks every caller runs (configure.mjs, install.mjs: rules files, git hooks, the skills folder, the manifest, uninstall) refuse a link at any component, an in-project target included, and make missing folders one at a time, checking each. A user whose own .claude, .github or .agents is an in-project link (a dotfile manager's) is refused where they install, the same rule the reads already apply; configure.mjs --global (no project root) is unchanged. Not covered: the check-then-make race. The walk and the later write are separate steps, so a local process that swaps a folder for a link between the last check and the write can still land the file outside the project. — test: scripts/lib/write-folder-pin.test.mjs
Changed
Internal — the canon re-copy round (UMB3-038), by blob id, from the org canon overlay: scripts/lib/wave-run.mjsb60827c6, scripts/lib/wave-run.test.mjsbccbaa58, scripts/lib/release-prune.mjs7f33a695, scripts/lib/release-prune.test.mjs96a4cceb, scripts/lib/asset-upload-mode.mjs0022e6fa, scripts/lib/asset-upload-mode.test.mjs573349d2, scripts/verify-release-shape.mjs270e43d1, scripts/verify-release-shape.test.mjs7c2b35c4 and scripts/release-notes.test.mjsf9dde432; the github/codeql-action pin in codeql.yml and scorecard.yml moved to 24c54180a607b1449ed407dd24f251e4e9147c8d (v4); scorecard.yml's paths-ignore gains NOTICE; claude-ai-zips.yml takes the canon's package-manager-cache: false on setup-node. These ship nothing in plugin/.
NOTICE follows the canon wording (BB-185): name, copyright line, the series URL and the licence; the room's own Origin line and attribution sentence are gone.
gold-standard stamps only the content it re-checked. A FILL or RE-VALIDATE that checks some sections of a file writes a new stamp on the line above each section it checked and leaves the file-level stamp's date and exemplars as they were (a section with no stamp of its own keeps that date); re-dating the file-level stamp over sections nobody re-read over-claimed their freshness. The rule is in skills/gold-standard/references/method.md and its plugin/ copy, and the RE-VALIDATE step in SKILL.md says the same. A prose rule, so no test.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
TheColliery
Uh oh!
There was an error while loading. Please reload this page.
Project writes refuse parent-folder links; gold-standard stamps
A project write (the config, the installer's files) now refuses a link at any folder between the project root and the file.
plugin/moved only for thegold-standardmethod reference, so this is a PATCH release.Security
.claudejunction or symlink) was made while the hooks refused to read the same file (the 3.23.3 read pin); a link that led outside the project was already refused. NowwriteRepoFileand the pre-checks every caller runs (configure.mjs,install.mjs: rules files, git hooks, the skills folder, the manifest, uninstall) refuse a link at any component, an in-project target included, and make missing folders one at a time, checking each. A user whose own.claude,.githubor.agentsis an in-project link (a dotfile manager's) is refused where they install, the same rule the reads already apply;configure.mjs --global(no project root) is unchanged. Not covered: the check-then-make race. The walk and the later write are separate steps, so a local process that swaps a folder for a link between the last check and the write can still land the file outside the project. — test:scripts/lib/write-folder-pin.test.mjsChanged
scripts/lib/wave-run.mjsb60827c6,scripts/lib/wave-run.test.mjsbccbaa58,scripts/lib/release-prune.mjs7f33a695,scripts/lib/release-prune.test.mjs96a4cceb,scripts/lib/asset-upload-mode.mjs0022e6fa,scripts/lib/asset-upload-mode.test.mjs573349d2,scripts/verify-release-shape.mjs270e43d1,scripts/verify-release-shape.test.mjs7c2b35c4andscripts/release-notes.test.mjsf9dde432; thegithub/codeql-actionpin incodeql.ymlandscorecard.ymlmoved to24c54180a607b1449ed407dd24f251e4e9147c8d(v4);scorecard.yml'spaths-ignoregainsNOTICE;claude-ai-zips.ymltakes the canon'spackage-manager-cache: falseonsetup-node. These ship nothing inplugin/.NOTICEfollows the canon wording (BB-185): name, copyright line, the series URL and the licence; the room's own Origin line and attribution sentence are gone.gold-standardstamps only the content it re-checked. A FILL or RE-VALIDATE that checks some sections of a file writes a new stamp on the line above each section it checked and leaves the file-level stamp's date and exemplars as they were (a section with no stamp of its own keeps that date); re-dating the file-level stamp over sections nobody re-read over-claimed their freshness. The rule is inskills/gold-standard/references/method.mdand itsplugin/copy, and the RE-VALIDATE step inSKILL.mdsays the same. A prose rule, so no test.Release page · CoalMine
All reactions