- Unit/integration tests: update hardcoded 42→43 in 7 test files
(agentSkillTools-mcp, agentSkills-catalog, agentSkills-generator,
agent-skills-content, agent-skills-discovery, listCapabilities-a2a)
to match the 43rd skill (config-codex-cli) added in the previous commit.
- Include CONFIG_SKILL_IDS in integration content test ALL_IDS so
skills/config-codex-cli/ is no longer "unexpected".
- listCapabilities.ts: change totalSkills from literal 42 to catalog.length
so it adapts to catalog growth automatically.
- computeCoverage assertions: include config.have in totalSkills check.
- CI: switch E2E artifact from upload-artifact path (ambiguous stripping)
to explicit tar archive. Fixes "Could not find a production build in
./.build/next" — the previous approach's download path was double-nested
(.build/next/next/...) due to upload-artifact LCA computation. tar -czf
stores .build/next/... relative to CWD; tar -xzf restores them verbatim.
- Also exclude .build/next/cache from the tar to keep archive lean.
- feat(translator): strip client_metadata in Responses→Chat translation
(Mistral 422 extra_forbidden fix); add regression test.
Upload the Next.js build from the build job and reuse it across E2E
shards to avoid rebuilding in each shard. Increase Playwright sharding
from 6 to 9, cache Chromium browsers, and lower the E2E timeout to match
the faster expected runtime.
Add a Codex CLI configuration skill for OmniRoute setup and ignore local
credential-bearing setup prompts.
Real fixes (alerts auto-close on next scan):
- agentSkills/generator: escape backslash before double-quote in YAML
frontmatter so a trailing backslash can't escape the closing quote
(js/incomplete-sanitization #297/#298)
- usage: replace /\s*\(RESTRICTED\)\s*$/ with a non-backtracking literal +
trim (js/polynomial-redos #275)
- i18n/request: skip __proto__/constructor/prototype in deepMergeFallback
(js/prototype-pollution-utility #274)
- scripts/ad-hoc/nvidia diag: log key presence only, never key chars
(js/clear-text-logging #273)
- tests: regression coverage for all three production fixes (YAML round-trip,
proto-pollution guard, RESTRICTED strip + ReDoS timing)
Docs:
- ARCHITECTURE.md: executor count 45->55, OAuth modules 15->16, agy.ts in list
Deploy skills (deploy-vps-*-cc/-cx/-ag): add --legacy-peer-deps (npm v11
peer-dep resolver crashes on the omniroute tree) and replace the
"; pm2 start" that masked a failed install with a proper && chain.
Implements the catalog.ts public API defined in §3.3 of the master plan:
- getCatalog(): AgentSkill[] — returns 42 entries, lazy-cached in module scope
- getSkillById(id): AgentSkill | null — lookup by canonical ID
- filterCatalog(opts): AgentSkill[] — filter by category and/or area
- computeCoverage(): SkillCoverage — reads skills/ dir and counts SKILL.md present
- refreshCatalog(): void — invalidates cache (used by tests + generator)
- fetchSkillMarkdown(id): Promise<SkillMarkdown> — reads local fs first,
falls back to GitHub raw fetch with 1h Next.js cache (for F4 /raw route)
API_SKILL_IDS and CLI_SKILL_IDS exported as readonly string arrays (D28 order).
Single source of truth for all consumers (REST routes, MCP, A2A).
