mirror of
https://github.com/conorbronsdon/avoid-ai-writing.git
synced 2026-09-19 01:32:11 +08:00
788c6675c1
* feat: seed OpenAI plugin skill resources * feat: add OpenAI plugin manifest and public metadata * feat: add routed ChatGPT and Codex skill graph * test: add OpenAI plugin validation and submission pack * fix: correct listing character-count evidence * feat: add typed cross-skill handoff contract * docs: encode agency review lenses for orchestration * feat: add machine-validated typed skill graph * feat: upgrade router to typed orchestration protocol * feat: connect detector to typed handoff network * feat: connect rewriter to verification and representation guards * feat: add typed file-edit handoffs and repair loop * feat: make preservation verifier a blocking typed gate * feat: connect interpretation guardrail to evidence handoffs * refactor: replace legacy yaml graph with validated json graph * test: validate skill graph and cross-skill contracts * ci: validate cross-skill orchestration graph * refactor: package connection validator inside router skill * refactor: keep connection validator inside packaged router skill * ci: run packaged connection validator before and after extraction * docs: align routing matrix with typed graph * test: expand routing evals for connected skill graph * fix: remove unintended reviewer detector cycle * fix: make interpretation reviewer terminal in skill graph * test: reject terminal outgoing edges and unbounded graph cycles * docs: align handoff contract with terminal reviewer semantics * docs: route fresh interpretation evidence through router * docs: document graph v2 and connection validation * fix: route fresh detector requests through orchestrator * test: enforce agency lenses and router-return semantics * test: cover terminal reviewer return-to-router flow * docs: add connected skill graph v2 to release notes * fix: remove unsupported skill policy products * fix: remove unsupported skill policy products * fix: remove unsupported skill policy products * fix: remove unsupported skill policy products * fix: remove unsupported skill policy products * fix: remove unsupported skill policy products * fix: remove unsupported skill policy products * fix: align plugin validator with graph v2 and ingestion policy * fix: synchronize bundled detector and verifier resources * fix: bundle detector beside preservation validator * ci: watch canonical detector resources for plugin drift * test: smoke packaged preservation residual detector * ci: exercise residual detector before and after packaging * fix(port): sync ChatGPT/Codex plugin version with canonical SKILL.md The merge with main moves the canonical skill to 3.28.0; the plugin manifest, listing, and submission pack still carried 3.25.1, so scripts/sync-plugin-skill.sh and scripts/validate-openai-plugin.py both exit 1 on the effective merge. Bump the three manifests and regenerate the copies the sync script owns. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): publish the plugin from the canonical repository Every public destination in the ChatGPT/Codex package pointed at the contributor's fork: websiteURL, privacyPolicyURL, termsOfServiceURL, homepage, repository, the submission listing, and SUPPORT.md. After a merge the canonical owner would not control the published legal and support pages. Point them all at conorbronsdon/avoid-ai-writing and make developerName/packagePublisher the identity that will be verified in the OpenAI portal. Packaging credit stays: NOTICE.md and listing.json now name the contributor explicitly. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(detector): CRLF input no longer bypasses the preservation validator validate() extracts frontmatter, tables and headings with regexes that anchor on a bare newline. A CRLF document matched none of them, so changing 'title: one' to 'title: two' in Windows-formatted frontmatter returned { ok: true, errors: [] }. This is a pre-existing bug in the canonical detector, not something PR #135 introduced - the bundled plugin copy is byte-identical to detector/validate.js - so the fix and the must-fire fixtures go in the canonical source and the generated copy is re-synced from it. Adds four CRLF fixtures to detector/validate.test.js; all four fail against the unpatched validator. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): make the manifest the only source for listing metadata submission/listing.json restates twelve manifest fields and only three of them were asserted, so the listing could ship a different developer name, support URL or description than the manifest it claims to describe - which is exactly the drift that put a fork's URLs into the public package. Assert every duplicated field against .codex-plugin/plugin.json, derive the hand-maintained character counts instead of trusting them, and require every public URL to sit under the canonical author.url so publication cannot move off this repository without turning the check red. Also: guard the canonical-copy comparison against a missing plugin copy (it raised FileNotFoundError instead of reporting), scope the hygiene scan to the packaged surface instead of walking .git, and restore the CLAUDE.md path-filter rationale the port deleted from the workflow. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): bundle every resource the canonical skill references OpenAI's submission contract says each skill must include any referenced scripts, templates, or assets, and the Codex skill layout has no shared- resource mechanism, so skills/avoid-ai-writing/SKILL.md (byte-identical to root SKILL.md) now ships with synced copies of detector/patterns.js, detector/validate.js, detector/CATEGORIES.md, scripts/check-style.js, and examples/ at the same relative paths. scripts/sync-plugin-skill.sh produces them and the existing regenerate-then-diff CI gate covers them. A new smoke test runs check-style and the preservation validator from inside the bundled tree and from an extracted package. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): manifest supportURL, ancestry-checked baseCommit, policy.products interface.supportURL now lives in .codex-plugin/plugin.json and the listing value is validated against it. Both submission files record baseCommit as the origin/main merge-base and the validator checks it is an ancestor of HEAD so it cannot drift silently; the verifier's copied patterns.js joins the deterministic-resource inventory. The validator accepts policy.products with CHAT and/or CODEX per the current agents/openai.yaml schema and keeps rejecting unknown policy keys, with tests. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): follow main to 3.29.0 after #128 landed Bump .codex-plugin/plugin.json and the submission metadata to 3.29.0, set baseCommit to the new origin/main merge-base, and regenerate the bundled copies so the sync gate is clean on the merge ref. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): changelog and README for the plugin package; harden packager and validator Qodo re-review items: a dated 3.29.0 changelog entry and a README section for the native ChatGPT/Codex package; the packager and validator now reject symlinked top-level package files; JSON loading rejects a non-object root with a validation error instead of crashing, with tests for list and null roots and for the symlink case (skipped where symlinks need privileges). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): packager and validator hardening, lone-CR preservation, workflow paths Qodo re-review items 6-11: the marketplace policy no longer demands install-time authentication for a skills-only package (ON_USE, the only other documented value); the packager rejects an output path that is a packaged input or sits inside an included directory and fails on a missing top-level package file instead of silently omitting it; the validator type-checks nested submission objects before access; the preservation validator normalizes CRLF only, so a lone carriage return changed inside code is reported again; LICENSE joins the workflow path filters. Tests for each; bundled validator copies re-synced. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): marketplace authentication policy is first-use, not install-time The skills-only package has no authentication flow or hosted service. The marketplace docs say policy.authentication decides whether auth happens on install or first use; first use never triggers for local skills, so ON_USE replaces ON_INSTALL. (Qodo item 6, deferred from the previous commit because the implementer sandbox could not write .agents/.) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): graph validator rejects malformed JSON cleanly; canonical URL is a constant Qodo items 8 and 9. validate_connections.py now checks the graph root and edge field types and reports through its validation path instead of raising, with a test script wired into CI. validate-openai-plugin.py pins CANONICAL_PROJECT_URL and requires author.url to equal it, so changing every public URL to a fork no longer passes; test added. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * fix(port): bound SVG parsing and stop empty skill names polluting the graph set Qodo items 19 and 20. The validator rejects SVGs carrying <!DOCTYPE or <!ENTITY declarations and anything over 256 KiB before handing text to ElementTree, closing the entity-expansion path; a skill whose frontmatter lacks a name reports that error once instead of inserting an empty name that cascades into router-graph errors. Tests for both. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * ci(port): full-history checkout so the baseCommit ancestry check can run The validator's merge-base --is-ancestor check needs the base commit in the checkout; actions/checkout's default depth of 1 made CI report it as "not a valid commit name". Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Conor Bronsdon <120674402+conorbronsdon@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
40 lines
1.5 KiB
JavaScript
40 lines
1.5 KiB
JavaScript
#!/usr/bin/env node
|
|
'use strict';
|
|
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
const { spawnSync } = require('node:child_process');
|
|
|
|
const root = path.resolve(process.argv[2] || '.');
|
|
const skillRoot = path.join(root, 'skills', 'avoid-ai-writing');
|
|
const fixtureRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'avoid-ai-writing-skill-'));
|
|
|
|
function run(args) {
|
|
const result = spawnSync(process.execPath, args, {
|
|
cwd: skillRoot,
|
|
encoding: 'utf8',
|
|
});
|
|
if (result.status !== 0) {
|
|
process.stderr.write(result.stdout || '');
|
|
process.stderr.write(result.stderr || '');
|
|
throw new Error(`command failed (${result.status}): node ${args.join(' ')}`);
|
|
}
|
|
return result.stdout.trim();
|
|
}
|
|
|
|
try {
|
|
const styleFixture = path.join(fixtureRoot, 'technical.md');
|
|
const beforeFixture = path.join(fixtureRoot, 'before.md');
|
|
const afterFixture = path.join(fixtureRoot, 'after.md');
|
|
fs.writeFileSync(styleFixture, '# API behavior\n\nUse the parser for each request.\n');
|
|
fs.writeFileSync(beforeFixture, '# Release note\n\nThe parser keeps `config.json` unchanged.\n');
|
|
fs.copyFileSync(beforeFixture, afterFixture);
|
|
|
|
const style = run(['scripts/check-style.js', styleFixture, '--config', 'examples/technical.json']);
|
|
const preservation = run(['detector/validate.js', beforeFixture, afterFixture]);
|
|
console.log(JSON.stringify({ ok: true, cwd: path.relative(root, skillRoot), style, preservation }, null, 2));
|
|
} finally {
|
|
fs.rmSync(fixtureRoot, { recursive: true, force: true });
|
|
}
|