Skip to content

feat: verify registered skills in package archives - #264

Closed
LadyBluenotes wants to merge 1 commit into
feat-maintainer-interactive-reviewfrom
feat-maintainer-package-verification
Closed

feat: verify registered skills in package archives#264
LadyBluenotes wants to merge 1 commit into
feat-maintainer-interactive-reviewfrom
feat-maintainer-package-verification

Conversation

@LadyBluenotes

@LadyBluenotes LadyBluenotes commented Sep 11, 2026

Copy link
Copy Markdown
Member

🎯 Changes

Stacked on #263. Adds intent maintainer verify-package <archive.tgz> to check the actual npm artifact before release, without extracting files or executing package contents.

  • Match the archive's name and version to the selected source package, then verify active registered skills and Git-visible skill-folder resources.
  • Follow inline Markdown links and images recursively inside the archive. Frontmatter source mappings remain provenance, not required runtime files.
  • Reject malformed or unsafe paths, links, duplicate files, unsupported entries, and oversized input. Return structured JSON findings and a nonzero exit code for CI failures.
  • Add only @remix-run/tar-parser@0.7.1, approximately 53 KB unpacked with no transitive dependencies. Reuse existing Markdown and frontmatter handling; load archive parsing only for this command.

Documentation is in #259. This checks packaging, not semantic correctness or script behavior. HTML links, reference-style links, dynamic paths, and script imports are not interpreted; files in source skill directories are still checked for presence.

✅ Checklist

  • I have followed the steps in the Contributing guide.
  • I have tested this code locally with pnpm run test:pr.

🚀 Release Impact

  • This change affects published code, and I have generated a changeset.
  • This change is docs/CI/dev-only (no release).

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 0473a880-affd-4827-a1e1-1c3b5691b4a7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Sep 11, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​remix-run/​tar-parser@​0.7.1761009285100

View full report

@socket-security

socket-security Bot commented Sep 11, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Medium
Low adoption: npm @remix-run/tar-parser

Location: Package overview

From: packages/intent/package.json → npm/@remix-run/tar-parser@0.7.1

ℹ Read more on: This package | This alert | What are unpopular packages?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Unpopular packages may have less maintenance and contain other problems.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@remix-run/tar-parser@0.7.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@nx-cloud

nx-cloud Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

View your CI Pipeline Execution ↗ for commit 9b3f3db

Command Status Duration Result
nx affected --targets=test:eslint,test:sherif,t... ✅ Succeeded 50s View ↗
nx run-many --targets=build ✅ Succeeded 2s View ↗

☁️ Nx Cloud last updated this comment at 2026-09-11 04:26:52 UTC

@LadyBluenotes LadyBluenotes mentioned this pull request Sep 11, 2026
Open
@pkg-pr-new

pkg-pr-new Bot commented Sep 11, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@tanstack/intent@264

commit: 9b3f3db

@codspeed-hq

codspeed-hq Bot commented Sep 11, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

🆕 9 new benchmarks

Performance Changes

Benchmark BASE HEAD Efficiency
🆕 scans a consumer workspace N/A 97.5 ms N/A
🆕 checks a shipped skills tree N/A 154.9 ms N/A
🆕 reports workspace drift N/A 94.8 ms N/A
🆕 loads a direct dependency skill N/A 47 ms N/A
🆕 loads a direct dependency from a large workspace N/A 75 ms N/A
🆕 loads direct dependency content as json N/A 56 ms N/A
🆕 empty node process (baseline) N/A 4.2 ms N/A
🆕 intent --help N/A 4.2 ms N/A
🆕 reports workspace drift with shared artifacts N/A 91.2 ms N/A

Comparing feat-maintainer-package-verification (9b3f3db) with main (b362525)1

Open in CodSpeed

Footnotes

  1. No successful run was found on feat-maintainer-interactive-review (422e4c2) during the generation of this report, so main (b362525) was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

@LadyBluenotes LadyBluenotes mentioned this pull request Sep 11, 2026
Merged
4 tasks
@LadyBluenotes
LadyBluenotes deleted the feat-maintainer-package-verification branch September 13, 2026 05:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@LadyBluenotes