Marketplace fix (#712, #705): Claude Desktop rejects plugins containing a
top-level bin/ directory, and .claude-plugin/marketplace.json packages the
repo root, so the installer directory is now cli/. Every reference updated
(package.json bin entry + files, shims, docs, tests, caveman-init require
path). Supersedes PR #726.
Security (PR #717 verified): quoteWinArg only quoted on whitespace/quotes,
leaving cmd.exe metacharacters (& | ^ < > % parens) unescaped on the
shell:true Windows spawn path. Attacker-influenced arguments (--with-init
cwd, --with-mcp-shrink value) could chain commands. Trigger regex now
covers the metacharacter set; quoting logic split into a platform-
independent, unit-tested helper.
Also:
- uninstall removes .caveman-active.prev, .caveman-mode-log.jsonl,
.caveman-statusline-suffix, .caveman-nudge-shown; keeps
.caveman-history.jsonl with a printed note; dry-run now says
'would remove' instead of lying (#635, supersedes PRs #693#636)
- Array.isArray guard in rewriteLegacyManagedHookCommands — malformed
hook event no longer crashes the installer mid-run (supersedes PR #646)
- gemini extensions install --consent: the security prompt hung every
piped/non-interactive install forever (#676, part of PR #664)
- OpenClaw skill stamps the real PINNED_REF version instead of hardcoded
1.0.0; new --no-always flag for load-on-demand installs (supersedes
PR #720)
- shims scope NPM_CONFIG_ALLOW_GIT=all to the npx call — npm >=12
defaults allow-git to none and EALLOWGITs github: installs (#698)
- .codex/config.toml ships hooks + codex_hooks keys so auto-activation
works on both sides of the codex-cli rename (#617)
- caveman-help card shows the Windows config path (%APPDATA%) (#723)
- caveman-parse.js added to HOOK_FILES, opencode payload (.cjs), and the
regenerated checksums.sha256; manifest now matches shipped hook
contents — release must bump PINNED_REF to a tag containing these files
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ySX6TBWZuvFze4ajf7Hpf
Refactor and harden the unified Node installer and related docs. Major changes:
- bin/install.js: validate --only ids, expand ~ for --config-dir, make Claude/install flows async (await hooks/init), add many CLI flags (--no-mcp-shrink, --with-hooks/--no-hooks, --skip-skills, --config-dir docs), preserve original backups once, avoid overwriting plugin/command files unless --force, and add opencode AGENTS.md fenced begin/end markers so installs/uninstalls can append/strip cleanly. Also add opencode idempotency probes for claude/gemini uninstall paths and better handling of opencode plugin payload.
- bin/lib/settings.js: safer removeCavemanHooks that validates shapes before mutating hooks.
- runInit/installHooks/downloadTo calls made async and awaited; runInit returns promise now.
- Docs and README/INSTALL/CONTRIBUTING/CLAUDE.md/src/hooks/README.md: update user-facing text to match new flags/behaviour, standardize use of $CLAUDE_CONFIG_DIR, clarify --with-init semantics, and note opencode/openclaw handling. Change command name usages from `/caveman:compress` to `/caveman-compress`.
- opencode: write fenced caveman block to AGENTS.md and handle legacy unfenced blocks; tests updated to expect fence markers.
These changes improve idempotency, safer upgrades/uninstalls, clearer UX around per-repo vs per-user init, and make the opencode rule block removable without destroying user content.
Expand the 25-line stub to a scannable 190-line guide reflecting the
post-cleanup repo layout. Adds:
- Sources-of-truth table covering all editable skill, agent, hook, and
installer files (skills/caveman-compress/, bin/install.js PROVIDERS,
tools/caveman-init.js, mcp-servers/caveman-shrink/).
- CI-mirrors table calling out plugins/caveman/* and dist/caveman.skill
as auto-rebuilt, edits-will-be-reverted.
- Step-by-step recipes for adding a new agent (PROVIDERS row +
--list verification) and a new skill (frontmatter + sync workflow).
- Test commands (npm test, compress safety, init, symlink), benchmark
and eval invocations, PR guidelines, and the load-bearing code-style
invariants (silent-fail hooks, JSONC-tolerant settings.js,
safeWriteFlag, CLAUDE_CONFIG_DIR).
Preserves caveman voice in the framing and Ideas section.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add project-level Cursor skill discovery support by introducing
`.cursor/skills/caveman/SKILL.md` as a copy of the canonical
`skills/caveman/SKILL.md`, without changing skill behavior.
Update the sync workflow to keep the new Cursor copy aligned with the
canonical source alongside existing synced targets, and include it in the
CI commit step. Also update CONTRIBUTING notes to document that this new
path is auto-synced and should not be edited directly.
Add GitHub issue templates for bug reports and feature requests tailored to the caveman persona, and add CONTRIBUTING.md describing how to propose changes to skills/caveman/SKILL.md (fork, edit, PR with before/after examples and rationale). These files help standardize contributions and make it easier for maintainers to review small, focused changes; also points contributors to ‘good first issue’ tasks.
