Refresh runtime support and harden MCP data paths - #33
Conversation
Serve the 121-skill pack from the registry instead of host catalogs. index_root and pack-root git checks keep the pin honest.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dcc3889ff
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (baseCommit !== "uncommitted" && !baseCommit.endsWith("-dirty") | ||
| && (indexedSourceIsDirty(pack.path) || indexedSourceChanged(sourceSnapshots) | ||
| && (indexedSourceIsDirty(pack.path, skillsRel) || indexedSourceChanged(sourceSnapshots) | ||
| || (initialHead !== undefined && gitHead(pack.path) !== initialHead))) { |
There was a problem hiding this comment.
When an earlier pack is modified while a later pack is being indexed—for example, a submodule update occurs during the lengthy second-pack scan—this check has already completed for the earlier pack, so its manifest and skill provenance retain the clean commit even though the source changed before publication. Because runtime freshness compares the database only with that manifest, the resulting outdated content is reported as healthy; retain each pack's snapshots/HEAD and validate all packs again immediately before the atomic rename.
Useful? React with 👍 / 👎.
Add DSH, Qoder, Qwen Code, and Kiro while retiring unsupported runtime surfaces. Use maintained structured parsers for config merges and preserve live outputs during stale cleanup. Align adapters, registries, schemas, documentation, and install coverage with the 25-target matrix.
Bind each index to clean source bytes, commit state, attribution, and registry membership. Reopen atomically replaced databases and fail closed on malformed or non-UTF-8 skills.
Reject stale supersession references, keep cross-project records read-only, and scrub forgotten content while retaining audit metadata. Make notification coalescing deterministic without wall-clock gates.
Require demonstrated value before safeguards, prefer maintained implementations over local wheels, and keep speculative findings from expanding accepted work or its tests.
Lyther
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 232c7b2. Configure here.
Prevent packs from attributing content reached through a symbolic SKILL.md. A real-filesystem regression points outside the pack and proves that indexing fails closed.
1 participant
Summary
rev-skillsthrough Grimoire and harden source provenance, attribution, UTF-8 validation, and atomic index reopening.Verification
npm test(12 repository suites)npm run checknpm run check:generated(25 targets)PATH=/opt/homebrew/bin:$PATH npm testinmcps/grimoire(46/46)PATH=/opt/homebrew/bin:$PATH npm testinmcps/synapse(40/40)npm audit --omit=devin the root and both MCP packages (0 vulnerabilities)Proof boundary
Qoder and Kiro model execution still require native account authentication. The intentionally dirty external source-pack worktrees are not part of these commits.