- Unit/integration tests: update hardcoded 42→43 in 7 test files
(agentSkillTools-mcp, agentSkills-catalog, agentSkills-generator,
agent-skills-content, agent-skills-discovery, listCapabilities-a2a)
to match the 43rd skill (config-codex-cli) added in the previous commit.
- Include CONFIG_SKILL_IDS in integration content test ALL_IDS so
skills/config-codex-cli/ is no longer "unexpected".
- listCapabilities.ts: change totalSkills from literal 42 to catalog.length
so it adapts to catalog growth automatically.
- computeCoverage assertions: include config.have in totalSkills check.
- CI: switch E2E artifact from upload-artifact path (ambiguous stripping)
to explicit tar archive. Fixes "Could not find a production build in
./.build/next" — the previous approach's download path was double-nested
(.build/next/next/...) due to upload-artifact LCA computation. tar -czf
stores .build/next/... relative to CWD; tar -xzf restores them verbatim.
- Also exclude .build/next/cache from the tar to keep archive lean.
- feat(translator): strip client_metadata in Responses→Chat translation
(Mistral 422 extra_forbidden fix); add regression test.
Real fixes (alerts auto-close on next scan):
- agentSkills/generator: escape backslash before double-quote in YAML
frontmatter so a trailing backslash can't escape the closing quote
(js/incomplete-sanitization #297/#298)
- usage: replace /\s*\(RESTRICTED\)\s*$/ with a non-backtracking literal +
trim (js/polynomial-redos #275)
- i18n/request: skip __proto__/constructor/prototype in deepMergeFallback
(js/prototype-pollution-utility #274)
- scripts/ad-hoc/nvidia diag: log key presence only, never key chars
(js/clear-text-logging #273)
- tests: regression coverage for all three production fixes (YAML round-trip,
proto-pollution guard, RESTRICTED strip + ReDoS timing)
Docs:
- ARCHITECTURE.md: executor count 45->55, OAuth modules 15->16, agy.ts in list
Deploy skills (deploy-vps-*-cc/-cx/-ag): add --legacy-peer-deps (npm v11
peer-dep resolver crashes on the omniroute tree) and replace the
"; pm2 start" that masked a failed install with a proper && chain.
