mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-08 07:37:48 +02:00
fix: make the installer runtime pass strict supply-chain vetting (#2503)
* fix: make the installer runtime pass strict supply-chain vetting
Remediate the four enterprise supply-chain vetting blockers from
affaan-m/ECC#2502 so the installer runtime (package.json + manifests +
scripts/lib/**) passes strict exact-pin evidence policy:
1. Remove the package.json `postinstall` lifecycle script (it only echoed a
post-install banner) and move that banner to an explicit opt-in
`npm run welcome` command. No install-time lifecycle script remains.
2. Exact-pin every dependency in package.json (dependencies + devDependencies)
to the versions already resolved in package-lock.json; no ^/~ ranges.
3. Replace non-ASCII characters on the installer runtime script/config surface:
em-dashes (U+2014) in scripts/lib/{path-safety,install-executor,
install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in
manifests/{install-components,install-modules}.json descriptions become
ASCII, so strict-surface Unicode scanners are clean.
4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file
already carries a complete hand-rolled validator enforcing the same
schemas/install-state.schema.json (ecc.install.v1) constraints, so the
installer closure is dependency-free (zero non-builtin bare requires).
Refs affaan-m/ECC#2502
* fix: avoid unpinned welcome invocations
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: validate translated skill frontmatter
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: repair skill frontmatter YAML
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: add MIT license to core skill manifests; pin verification-loop tsc invocation
* fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail)
* chore(deps): sync lockfiles with exact-pinned package.json
Regenerate package-lock.json and yarn.lock so the pinned dependency
specs are reflected in both lockfiles. npm ci and Yarn's --immutable
install now pass the sync check. The resolution tree is unchanged
(231 yarn resolutions, byte-identical set; zero npm transitive drift);
only the root descriptor strings move from ranges to the versions
already resolved in the committed lockfiles.
Addresses the Codex P1 on #2503.
---------
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>
This commit is contained in:
Samarjeet Singh Tomar
co-authored by
Samarjeet Singh Tomar
Samarjeet Singh Tomar
parent
5da21c2b66
commit
754b8dd76c
@@ -59,7 +59,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@eslint/js@npm:^9.39.2":
|
||||
"@eslint/js@npm:9.39.2":
|
||||
version: 9.39.2
|
||||
resolution: "@eslint/js@npm:9.39.2"
|
||||
checksum: 10c0/00f51c52b04ac79faebfaa65a9652b2093b9c924e945479f1f3945473f78aee83cbc76c8d70bbffbf06f7024626575b16d97b66eab16182e1d0d39daff2f26f5
|
||||
@@ -114,7 +114,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@iarna/toml@npm:^2.2.5":
|
||||
"@iarna/toml@npm:2.2.5":
|
||||
version: 2.2.5
|
||||
resolution: "@iarna/toml@npm:2.2.5"
|
||||
checksum: 10c0/d095381ad4554aca233b7cf5a91f243ef619e5e15efd3157bc640feac320545450d14b394aebbf6f02a2047437ced778ae598d5879a995441ab7b6c0b2c2f201
|
||||
@@ -203,7 +203,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@opencode-ai/plugin@npm:^1.16.2":
|
||||
"@opencode-ai/plugin@npm:1.17.3":
|
||||
version: 1.17.3
|
||||
resolution: "@opencode-ai/plugin@npm:1.17.3"
|
||||
dependencies:
|
||||
@@ -333,6 +333,18 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"ajv@npm:8.20.0":
|
||||
version: 8.20.0
|
||||
resolution: "ajv@npm:8.20.0"
|
||||
dependencies:
|
||||
fast-deep-equal: "npm:^3.1.3"
|
||||
fast-uri: "npm:^3.0.1"
|
||||
json-schema-traverse: "npm:^1.0.0"
|
||||
require-from-string: "npm:^2.0.2"
|
||||
checksum: 10c0/5df9a1c8f83863cde1bd3a9ddb426f599718f88e3dc9153616c79fb28e0be455335830d7f21d745576519f057b371352daa31047b6a33d7036fe08777d60cf2a
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"ajv@npm:^6.14.0":
|
||||
version: 6.14.0
|
||||
resolution: "ajv@npm:6.14.0"
|
||||
@@ -345,18 +357,6 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"ajv@npm:^8.20.0":
|
||||
version: 8.20.0
|
||||
resolution: "ajv@npm:8.20.0"
|
||||
dependencies:
|
||||
fast-deep-equal: "npm:^3.1.3"
|
||||
fast-uri: "npm:^3.0.1"
|
||||
json-schema-traverse: "npm:^1.0.0"
|
||||
require-from-string: "npm:^2.0.2"
|
||||
checksum: 10c0/5df9a1c8f83863cde1bd3a9ddb426f599718f88e3dc9153616c79fb28e0be455335830d7f21d745576519f057b371352daa31047b6a33d7036fe08777d60cf2a
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"ansi-regex@npm:^5.0.1":
|
||||
version: 5.0.1
|
||||
resolution: "ansi-regex@npm:5.0.1"
|
||||
@@ -403,7 +403,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"c8@npm:^11.0.0":
|
||||
"c8@npm:11.0.0":
|
||||
version: 11.0.0
|
||||
resolution: "c8@npm:11.0.0"
|
||||
dependencies:
|
||||
@@ -578,17 +578,17 @@ __metadata:
|
||||
version: 0.0.0-use.local
|
||||
resolution: "ecc-universal@workspace:."
|
||||
dependencies:
|
||||
"@eslint/js": "npm:^9.39.2"
|
||||
"@iarna/toml": "npm:^2.2.5"
|
||||
"@opencode-ai/plugin": "npm:^1.16.2"
|
||||
"@eslint/js": "npm:9.39.2"
|
||||
"@iarna/toml": "npm:2.2.5"
|
||||
"@opencode-ai/plugin": "npm:1.17.3"
|
||||
"@types/node": "npm:25.9.2"
|
||||
ajv: "npm:^8.20.0"
|
||||
c8: "npm:^11.0.0"
|
||||
eslint: "npm:^10.6.0"
|
||||
globals: "npm:^17.4.0"
|
||||
markdownlint-cli: "npm:^0.48.0"
|
||||
sql.js: "npm:^1.14.1"
|
||||
typescript: "npm:^6.0.3"
|
||||
ajv: "npm:8.20.0"
|
||||
c8: "npm:11.0.0"
|
||||
eslint: "npm:10.6.0"
|
||||
globals: "npm:17.4.0"
|
||||
markdownlint-cli: "npm:0.48.0"
|
||||
sql.js: "npm:1.14.1"
|
||||
typescript: "npm:6.0.3"
|
||||
bin:
|
||||
ecc: scripts/ecc.js
|
||||
ecc-control-pane: scripts/control-pane.js
|
||||
@@ -676,7 +676,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"eslint@npm:^10.6.0":
|
||||
"eslint@npm:10.6.0":
|
||||
version: 10.6.0
|
||||
resolution: "eslint@npm:10.6.0"
|
||||
dependencies:
|
||||
@@ -907,7 +907,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"globals@npm:^17.4.0":
|
||||
"globals@npm:17.4.0":
|
||||
version: 17.4.0
|
||||
resolution: "globals@npm:17.4.0"
|
||||
checksum: 10c0/2be9e8c2b9035836f13d420b22f0247a328db82967d3bebfc01126d888ed609305f06c05895914e969653af5c6ba35fd7a0920f3e6c869afa60666c810630feb
|
||||
@@ -1206,7 +1206,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"markdownlint-cli@npm:^0.48.0":
|
||||
"markdownlint-cli@npm:0.48.0":
|
||||
version: 0.48.0
|
||||
resolution: "markdownlint-cli@npm:0.48.0"
|
||||
dependencies:
|
||||
@@ -1876,7 +1876,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"sql.js@npm:^1.14.1":
|
||||
"sql.js@npm:1.14.1":
|
||||
version: 1.14.1
|
||||
resolution: "sql.js@npm:1.14.1"
|
||||
checksum: 10c0/3491b7642b8b6d89926e4cf1807c01697df7e3f7283b94aaebc026e6c38aaf9496065e9daf25de3109e51df835150d4f795f5249f22a1d3e6a3bb1f2e32c0710
|
||||
@@ -1998,7 +1998,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"typescript@npm:^6.0.3":
|
||||
"typescript@npm:6.0.3":
|
||||
version: 6.0.3
|
||||
resolution: "typescript@npm:6.0.3"
|
||||
bin:
|
||||
@@ -2008,7 +2008,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"typescript@patch:typescript@npm%3A^6.0.3#optional!builtin<compat/typescript>":
|
||||
"typescript@patch:typescript@npm%3A6.0.3#optional!builtin<compat/typescript>":
|
||||
version: 6.0.3
|
||||
resolution: "typescript@patch:typescript@npm%3A6.0.3#optional!builtin<compat/typescript>::version=6.0.3&hash=5786d5"
|
||||
bin:
|
||||
|
||||
Reference in New Issue
Block a user