The /spec and /plan commands write spec, plan, and todo artifacts to paths that /build and the spec/plan skills read back. When a producer moves an artifact without updating the consumers, the pipeline breaks and nothing in CI catches it: the command-parity check only compares descriptions, not paths. PR #93 hit exactly this, pointing /spec and /plan at docs/features/[name]/ while /build still required SPEC.md and tasks/plan.md.
validate-artifact-paths.js enforces one canonical set of artifact paths across every file in the pipeline (the spec/plan/build commands, the spec-driven-development and planning-and-task-breakdown skills, and the getting-started and adoption guides). Any spec/plan/todo artifact path outside the allowlist fails CI, so changing the convention has to touch the allowlist and every guarded file in the same change.
Scope is deliberately narrow: only spec/plan/todo artifacts, only the pipeline files; it is not a general markdown path linter. Wired into the validate-commands CI job alongside its test.
actions/checkout@v4 and actions/setup-node@v4 target the deprecated Node 20
runner runtime, so every run logs forced-Node-24 deprecation annotations.
Harmonize checkout on the v6 major already used by the other three jobs,
bump setup-node to v6, and move node-version from Node 20 (EOL 2026-04-30)
to Node 24 LTS.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
materializeWorkspace() creates directories in os.tmpdir() but
runBehavioral() never cleans them up on success or failure. If
execFileSync throws (timeout, signal, OOM), the workspace persists
in /tmp indefinitely with fixture data. The test file
run-evals-test.js uses try/finally cleanup (line 234), proving
the pattern was known but omitted in production code.
Fix: Wrap eval execution in try/finally with best-effort
fs.rmSync cleanup.
The skillName argument from --behavioral has zero validation and is
used directly in path.join() for reading .json files, reading
SKILL.md, and WRITING .grading.json results. A value like
'../../etc/passwd' traverses outside the project directory for
both reads and writes.
Fix: Validate skillName against /^[a-z0-9]+(-[a-z0-9]+)*$/ before
any filesystem operations. This matches the existing KEBAB_CASE
validation in skill-lint.js.
The explicit agents array in .claude-plugin/plugin.json causes Claude Code
to load zero subagents; it discovers agents/*.md on its own, and the explicit
list suppresses that discovery. Reproduced on Claude Code 2.1.219: with the
key present, plugin details reports Agents (0); with it removed, all four load
(code-reviewer, security-auditor, test-engineer, web-performance-auditor).
Safe to omit since #260 moved agents/README.md into docs/, so the agents/
directory now holds only real agent definitions. Scoped to the Claude Code
manifest only; the Codex manifest is untouched.
'Native dependency audit' collides with the established meaning of
native dependencies (compiled modules); use the same unambiguous
phrasing as the shipping-and-launch checkbox in this PR.
Addresses the clarity nit in #236 review: a single supporting doc stays a
loose file, and the skill-local references/ subdir is for grouping several
related docs that travel with the skill. Ties the new bullet back to the
existing Supporting files entry so the framings read as one.
Follow-up to #419, addressing the remaining normative npm-family
commands federicobartoli's grep on #404 identified:
- incremental-implementation: the four increment-checklist exit criteria
and the example prompt now use the repository's own test/build/
typecheck/lint commands, pointing at the TDD skill's Discover the
Stack First section
- planning-and-task-breakdown: task-template verification lines use the
template's placeholder style instead of hardcoded npm commands
- shipping-and-launch: the security checkbox names the ecosystem's
dependency audit rather than npm audit alone
- debugging-and-error-recovery: the diagnosis/bisect/verify command
blocks are labeled as npm examples with substitution notes
- references/security-checklist.md: OWASP row 6 generalizes npm audit
to the native dependency audit
- security-and-hardening needed no change: its SKILL.md was already
neutralized (detected-package-manager wording)
Ride-along: pins the below-zero debit behavior (ValueError) in TDD eval
case 3, per nucliweb's non-blocking review note on #419.
Unquoted ${CLAUDE_PROJECT_DIR} in SDD-CACHE and SIMPLIFY-IGNORE setup
examples breaks when the project path contains spaces, the same class
of failure fixed for SessionStart in #214.
Co-authored-by: Cursor <cursoragent@cursor.com>
- SKILL.md gains a 'Discover the Stack First' step: identify the
language, build system, checked-in wrappers, test framework, and
documented commands before choosing any test command, and run the
repository's own focused/full-suite commands throughout the loop
- verification checklist no longer hardcodes 'npm test'; red flag added
for reaching for a default test command without checking the repo
- references/testing-patterns.md relabeled in place as JavaScript/
TypeScript examples illustrating the universal principles (no
relocation, per the #361/#236 sequencing agreed in the issue)
- new behavioral eval: a Python/unittest fixture verifying the skill
adapts to non-npm repository tooling
Gives contributors a short intake path when a skill assumes the wrong
ecosystem or outdated steps, so gaps like #404 reach maintainers via
the repo instead of external channels. Closes the intake-only scope
from #412.
Co-authored-by: Cursor <cursoragent@cursor.com>
The References table pointed orchestration-patterns.md at
context-engineering, but that skill never mentions it. The reference
is actually cited by doubt-driven-development (SKILL.md lines 46 and
229), which documents the "personas don't invoke personas" rule from
references/orchestration-patterns.md.
Test 10 pipes malformed JSON through the real hook, but the hook's jq
guard exits with 'error: missing jq' before parsing on machines without
jq (default Git for Windows, minimal Linux). The suite then reports a
failure unrelated to the contributor's change; tests 1-9 only exercise
the extracted filter_file and keep passing.
Mirror session-start-test.sh, which CONTRIBUTING documents as validating
both the jq and no-jq branches: with jq on PATH keep the existing
bad-JSON warning assertion, without it assert the documented missing-jq
guard message.
Verified on Windows (Git Bash): 21 passed, 0 failed both with jq 1.8.1
on PATH and without jq.
Addy Osmani