fix(security): derive better-auth managed-object write denies from th… #9397
ci.yml
on: push
filter
9s
Test Core
45s
Dogfood Regression Gate
4m 28s
Build Core
1m 49s
Build Docs
0s
Check Generated Artifacts
0s
Annotations
3 errors
|
Test Core
Process completed with exit code 1.
|
|
Test Core
command (/home/runner/work/framework/framework/packages/create-objectstack) /opt/hostedtoolcache/node/20.20.2/x64/bin/pnpm run test exited (1)
|
|
src/template-consistency.test.ts > skills catalog boundary > no customer-facing surface advertises a repo-root skills install:
packages/create-objectstack/src/template-consistency.test.ts#L339
AssertionError: these lines advertise `skills add objectstack-ai/framework` without the /skills subpath — repo-root + --all installs internal skills: expected [ Array(1) ] to deeply equal []
- Expected
+ Received
- []
+ [
+ "packages/create-objectstack/CHANGELOG.md:99:- 809214f: Stop leaking repo-internal skills into scaffolded projects. The scaffolder (and the docs) advertised `npx skills add objectstack-ai/framework --all`, and the skills CLI's `--all` implies `--skill '*'` — which includes even `metadata.internal` skills — so repo-internal tooling like `.claude/skills/dogfood-verification` landed in every new project's `.agents/skills/`. All install commands are now scoped to the published catalog via the `/skills` subpath (`npx skills add objectstack-ai/framework/skills --all`), the internal skill is additionally marked `metadata.internal: true` to hide it from interactive discovery, and a template-consistency ratchet plus a scaffold-e2e assertion keep the boundary from regressing.",
+ ]
❯ src/template-consistency.test.ts:339:7
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
build-output
|
13.4 MB |
sha256:d4e5b6f16957f0b371835a869a2e54214b79b31b131f96cf779c3b6a78cea02c
|
|