Skip to content

Cycles Budget Guard v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@amavashev amavashev released this 22 Jul 19:45
· 28 commits to main since this release
v0.2.0
7d765c6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cycles Budget Guard v0.2.0

This release strengthens the plugin's operational safety, transport boundary, diagnostics, packaging checks, and public-install verification.

Highlights

  • Adds the secret-safe /cycles-budget-guard:doctor command backed by the production configuration parser.
  • Keeps exact Cycles MCP recovery tools available during invalid plugin configuration while continuing to gate namespace lookalikes.
  • Requires HTTPS for non-loopback Cycles endpoints and rejects query- or fragment-bearing base URLs, including empty delimiters.
  • Never follows redirects with X-Cycles-API-Key; 3xx reserve responses are authoritative denials rather than fail-open outages.
  • Expands CI to Node.js 22 and 24 across Ubuntu, Windows, and macOS, with strict plugin and marketplace validation.
  • Adds metadata consistency enforcement, bounded install smoke tests, current-Claude public-repository tests, dependency automation, security guidance, and structured issue forms.

Upgrade note

Non-loopback CYCLES_BASE_URL values must now use HTTPS. Redirecting Cycles endpoints are rejected; configure the final HTTPS endpoint directly. Plain HTTP remains available for localhost, 127.0.0.0/8, and [::1] development endpoints.

Install or upgrade

/plugin marketplace update runcycles
/plugin install cycles-budget-guard@runcycles

Verification

  • 81 tests passed with 96.24% statement, 92.50% branch, 100% function, and 97.46% line coverage.
  • CI passed on Node.js 22 and 24 across Ubuntu, Windows, and macOS.
  • Strict plugin and marketplace validation, metadata/tag assertions, isolated installation smoke testing, CodeQL, actionlint, link checks, and dependency audit passed.
  • A fresh install from the public repository passed against the current Claude Code release.

See CHANGELOG.md and AUDIT.md for details.

Assets 2
Loading