External/caveman
1
0
Fork 0
mirror of https://github.com/JuliusBrussee/caveman.git synced 2026-08-11 13:21:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
266 Commits 12 Branches 17 Tags
main
Commit Graph
3 Commits
Author SHA1 Message Date
Julius BrusseeandClaude Fable 5 ed1fbb7f4c fix(install): rename bin/ to cli/, harden Windows quoting, clean uninstall 
Marketplace fix (#712, #705): Claude Desktop rejects plugins containing a
top-level bin/ directory, and .claude-plugin/marketplace.json packages the
repo root, so the installer directory is now cli/. Every reference updated
(package.json bin entry + files, shims, docs, tests, caveman-init require
path). Supersedes PR #726.

Security (PR #717 verified): quoteWinArg only quoted on whitespace/quotes,
leaving cmd.exe metacharacters (& | ^ < > % parens) unescaped on the
shell:true Windows spawn path. Attacker-influenced arguments (--with-init
cwd, --with-mcp-shrink value) could chain commands. Trigger regex now
covers the metacharacter set; quoting logic split into a platform-
independent, unit-tested helper.

Also:
- uninstall removes .caveman-active.prev, .caveman-mode-log.jsonl,
  .caveman-statusline-suffix, .caveman-nudge-shown; keeps
  .caveman-history.jsonl with a printed note; dry-run now says
  'would remove' instead of lying (#635, supersedes PRs #693 #636)
- Array.isArray guard in rewriteLegacyManagedHookCommands — malformed
  hook event no longer crashes the installer mid-run (supersedes PR #646)
- gemini extensions install --consent: the security prompt hung every
  piped/non-interactive install forever (#676, part of PR #664)
- OpenClaw skill stamps the real PINNED_REF version instead of hardcoded
  1.0.0; new --no-always flag for load-on-demand installs (supersedes
  PR #720)
- shims scope NPM_CONFIG_ALLOW_GIT=all to the npx call — npm >=12
  defaults allow-git to none and EALLOWGITs github: installs (#698)
- .codex/config.toml ships hooks + codex_hooks keys so auto-activation
  works on both sides of the codex-cli rename (#617)
- caveman-help card shows the Windows config path (%APPDATA%) (#723)
- caveman-parse.js added to HOOK_FILES, opencode payload (.cjs), and the
  regenerated checksums.sha256; manifest now matches shipped hook
  contents — release must bump PINNED_REF to a tag containing these files

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ySX6TBWZuvFze4ajf7Hpf
 2026-07-21 02:01:27 +02:00
Julius Brussee 1ce38a2295 refactor: consolidate hooks/ rules/ tools/ mcp-servers/ under src/ 
Drops top-level entry count from ~26 to ~22 to align with conventions in
mature skill libraries (anthropics/skills, vercel-labs/skills). agents/,
commands/, skills/, and .claude-plugin/plugin.json stay at the repo root
because Claude Code auto-discovers them at the plugin root.

What moved:
  hooks/        → src/hooks/
  rules/        → src/rules/
  tools/        → src/tools/
  mcp-servers/  → src/mcp-servers/

Path references updated atomically in:
  - bin/install.js (HOOKS_REMOTE, INIT_SCRIPT_URL, repoRoot/sourceDir paths,
    user-facing install hints)
  - .claude-plugin/plugin.json (CLAUDE_PLUGIN_ROOT/src/hooks/...)
  - package.json files: array
  - tests/{test_hooks,test_symlink_flag,test_caveman_init,test_mcp_shrink,
    verify_repo}: bash/node command paths and require() args
  - tests/verify_repo.py: also drops the dead .cursor/.windsurf/.clinerules/
    copilot-instructions/caveman dotdir-mirror checks left behind by be714a3
    plus adds bin/install.js + bin/lib/settings.js regression guards
  - commands/caveman-init.toml prompt
  - src/mcp-servers/caveman-shrink/package.json repository.directory
  - CLAUDE.md, CONTRIBUTING.md, README.md, src/hooks/install.{sh,ps1},
    src/hooks/uninstall.{sh,ps1}, src/tools/caveman-init.js: docstrings,
    URL paths, source-of-truth tables

External raw.githubusercontent.com URL updates (referrers, blog posts) are
the maintainer's lane.
 2026-05-10 14:26:11 +02:00
Julius BrusseeandClaude Opus 4.7 c28067e22d chore: move caveman.skill build artifact to dist/ 
The caveman.skill ZIP is regenerated by CI on every push and lived at
the repo root, where users mistook it for an editable source. Moving it
to dist/ makes its build-product nature obvious while keeping it
tracked so GitHub release links and npm packaging keep working.

Updates:
- git mv caveman.skill -> dist/caveman.skill
- .github/workflows/sync-skill.yml rebuild step now writes to dist/
- .gitignore ignores dist/* but allows dist/caveman.skill
- package.json files array includes dist/caveman.skill for npm pack
- CONTRIBUTING.md and tests/verify_repo.py path references updated

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-10 13:20:35 +02:00