Repository navigation
Docs freshness sweep (28 MCP tools, Node 22.18, package caveats) + CI least-privilege hardening - #420
Conversation
…cosystem audit Applies the fixes queued by the six-lane ecosystem audit (pm-fpod; lanes pm-kes3/pm-6vy7/pm-hfli/pm-3l76/pm-p99b/pm-mo2v). Docs freshness (pm-p99b): - 26 -> 28 MCP tools in README.md, plugins/pm-claude/README.md (x3), plugin.json, and pm-init.md; plugin narrow-tool table gains pm_next, pm_focus, pm_profile; plugin + marketplace manifests bumped 1.4.0 -> 1.4.1 - Node 20 -> 22.18 in CONTRIBUTING, ARCHITECTURE, ONBOARDING (engines truth) - CONTRIBUTING CI matrix updated to ubuntu(22,24)+macos(24), nightly Windows/25 - Package-only commands footnoted as such: comments-audit/normalize (governance-audit), test-runs (linked-test-adapters), completion (guide-shell), plus first-mention caveats for reindex/normalize/calendar in AGENT_GUIDE/ONBOARDING/CONFIGURATION/ARCHITECTURE - EXTENSIONS.md scaffold-capability matrix deduplicated into a summary + link to the canonical SDK.md section; first-party package list now links all 11 package READMEs; docs/README.md links AGENTS.md and PRD.md - ONBOARDING declares AGENT_GUIDE as the canonical-loop source - starter-extension example moved to package-first vocabulary (pm install/pm package --reload/pm package doctor) - six built-in statuses wording fix in COMMANDS.md CI/CD hardening (pm-mo2v): - auto-release.yml permissions: actions: write -> read (gh run list/watch only read run state); ci-workflow-contract spec updated to match - check-secrets-lib gains anthropic-api-key, openai-api-key, and gitlab-token rules with spec coverage; repo scan stays clean - (live settings, no code) release environment restricted by deployment branch policy to main + v*.*.* tags Follow-ups filed: pm-3wsi (P1 declarative install misreport), pm-ghf1 (P2 reserved item-field collisions invisible to SDK preflight), pm-llrp (SDK DX polish), pm-gdi7 (agent-UX output polish), pm-z1pv (context/next hot-path latency). Verification: 5278 tests, 100% stmt/branch/func/line coverage; eslint zero output; docs-skills gate green; secret scan clean; changelog check green; Claude-plugin smoke green; Sentry 0 critical/high (14d); telemetry gate ok (finish_error_rate 0.62%, no missing error codes). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
…arketplace tool count - openai-api-key rule now matches URL-safe base64 (_ and -) like its anthropic/gitlab siblings; sk-proj- keys with underscores were missed - underscore test variant added so the gap cannot regress silently - marketplace.json + .claude-plugin/marketplace.json descriptions said 25 MCP tools; corrected to 28 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
…gging Negative lookahead keeps sk-/sk-proj-/sk-svcacct- coverage while Anthropic keys fire only anthropic-api-key; regression guarded with not.toContain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
📝 WalkthroughWalkthroughThis PR bumps the pm-claude plugin/marketplace version to 1.4.1 and updates MCP tool count references (26→28) across manifests and docs. It adds numerous PM tracker task/history/issue/reminder records documenting an ecosystem audit's lanes. It extends secret-detection rules, tightens auto-release workflow permissions, and updates several documentation files. ChangesPlugin Version and MCP Tool Count Bump
PM Audit Task and History Records
Secrets Scanning Rules and Workflow Permissions
Documentation and Changelog Updates
Estimated code review effort: 2 (Simple) | ~12 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request implements a comprehensive ecosystem audit and optimization pass across the CLI, SDK, packages, documentation, and CI. Key changes include upgrading the Node.js prerequisite to 22.18+, updating documentation to reflect 28 MCP tools, adding package-only command caveats, and hardening CI permissions (changing actions permission to read). Additionally, new secret scanning rules for Anthropic, OpenAI, and GitLab tokens were added to check-secrets-lib.mjs along with corresponding unit tests. Feedback on the changes highlights a backtracking and length-enforcement issue in the newly added openai-api-key regular expression, which can be resolved using the suggested explicit alternation.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Greptile SummaryThis PR refreshes documentation and release-supporting metadata for the current pm ecosystem. The main changes are:
Confidence Score: 5/5Safe to merge with minimal risk. Changes are mostly documentation, metadata, workflow permission narrowing, and additive scanner coverage. Reviewed changed code paths and matching tests; no blocking correctness or security issues were found. No files require special attention.
 T-Rex LogsWhat T-Rex did
Important Files Changed
Sequence Diagram%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Audit as Ecosystem audit
participant Docs as Docs/plugin metadata
participant CI as Auto-release workflow
participant Scan as Secret scanner
participant Tests as Contract/unit tests
Audit->>Docs: Refresh tool counts, Node version, package caveats
Audit->>CI: Narrow actions permission to read
Audit->>Scan: Add Anthropic/OpenAI/GitLab token rules
Docs->>Tests: Docs/skills and changelog gates verify freshness
CI->>Tests: Workflow contract asserts actions: read
Scan->>Tests: Unit specs cover new token patterns and overlap handling
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Audit as Ecosystem audit
participant Docs as Docs/plugin metadata
participant CI as Auto-release workflow
participant Scan as Secret scanner
participant Tests as Contract/unit tests
Audit->>Docs: Refresh tool counts, Node version, package caveats
Audit->>CI: Narrow actions permission to read
Audit->>Scan: Add Anthropic/OpenAI/GitLab token rules
Docs->>Tests: Docs/skills and changelog gates verify freshness
CI->>Tests: Workflow contract asserts actions: read
Scan->>Tests: Unit specs cover new token patterns and overlap handling
Reviews (3): Last reviewed commit: "Match GitLab routable PAT format (dots) ..." | Re-trigger Greptile |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/pm/history/pm-hfli.jsonl:
- Around line 5-6: The history entry note in the pm-hfli log has an inconsistent
verification date: the comment text says 2026-07-03 while the recorded timestamp
is 2026-07-02T22:04:07.494Z. Update the text in the metadata/comments entry to
match the actual run date, or if the later date is correct, move the entry so
the timestamp and note are aligned; use the metadata/comments and
metadata/updated_at fields in this JSONL record to locate it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4a1c38f5-9a9c-4307-b402-f75a8c30521c
📒 Files selected for processing (47)
.agents/plugins/marketplace.json.agents/pm/history/pm-3l76.jsonl.agents/pm/history/pm-3wsi.jsonl.agents/pm/history/pm-6vy7.jsonl.agents/pm/history/pm-7zs0.jsonl.agents/pm/history/pm-fpod.jsonl.agents/pm/history/pm-gdi7.jsonl.agents/pm/history/pm-ghf1.jsonl.agents/pm/history/pm-hfli.jsonl.agents/pm/history/pm-kes3.jsonl.agents/pm/history/pm-llrp.jsonl.agents/pm/history/pm-mo2v.jsonl.agents/pm/history/pm-p99b.jsonl.agents/pm/history/pm-z1pv.jsonl.agents/pm/issues/pm-3wsi.toon.agents/pm/issues/pm-ghf1.toon.agents/pm/reminders/pm-7zs0.toon.agents/pm/tasks/pm-3l76.toon.agents/pm/tasks/pm-6vy7.toon.agents/pm/tasks/pm-fpod.toon.agents/pm/tasks/pm-gdi7.toon.agents/pm/tasks/pm-hfli.toon.agents/pm/tasks/pm-kes3.toon.agents/pm/tasks/pm-llrp.toon.agents/pm/tasks/pm-mo2v.toon.agents/pm/tasks/pm-p99b.toon.agents/pm/tasks/pm-z1pv.toon.claude-plugin/marketplace.json.github/workflows/auto-release.ymlCHANGELOG.mdCONTRIBUTING.mdREADME.mddocs/AGENT_GUIDE.mddocs/ARCHITECTURE.mddocs/COMMANDS.mddocs/CONFIGURATION.mddocs/EXTENSIONS.mddocs/ONBOARDING.mddocs/README.mddocs/examples/starter-extension/README.mdmarketplace.jsonplugins/pm-claude/.claude-plugin/plugin.jsonplugins/pm-claude/README.mdplugins/pm-claude/commands/pm-init.mdscripts/check-secrets-lib.mjstests/integration/ci-workflow-contract.spec.tstests/unit/scripts/check-secrets-lib.spec.ts
The (?:proj-|svcacct-)? alternation was unenforceable: prefix characters are a subset of the payload class, so backtracking absorbs the prefix into the payload and the post-prefix length floor never applies (Gemini's suggested alternation has the identical backtracking behavior). The equivalent simpler pattern matches the exact same strings; prefix formats stay documented in the spec fixtures. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
|
/gemini review |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
There was a problem hiding this comment.
Code Review
This pull request updates the repository's documentation and hardens CI/CD configurations following a full ecosystem audit. Key changes include updating Node.js prerequisites to 22.18+, correcting MCP tool counts to 28, adding caveats for package-only commands, deduplicating documentation, and transitioning starter-extension vocabulary to package-first commands. Additionally, it restricts auto-release permissions to actions: read and introduces new secret-scanning rules for Anthropic, OpenAI, and GitLab tokens. Feedback on the changes suggests enhancing the new GitLab token regular expression to support newer formats that include dots, ensuring more robust leak detection.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Per Gemini round-2 review: glpat-<base64>.<len>.<crc> tokens were cut short at the first dot. Character class now includes the dot; covered with a routable-format fixture. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
|
/gemini review |
|
@coderabbitai full review |
✅ Action performedFull review finished. |
|
Warning Gemini encountered an error creating the review. You can try again by commenting |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request performs a comprehensive ecosystem audit and optimization pass across the project. Key changes include updating the Node.js requirement to 22.18+, hardening CI/CD workflows by reducing permissions, and adding new secret detection rules for Anthropic, OpenAI, and GitLab tokens. Documentation has been updated to reflect these changes, including tool counts, capability matrices, and improved onboarding guidance. No review comments were provided for this pull request.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Applies the fixes queued by the 2026-07-02 full ecosystem audit (umbrella [pm-fpod], lanes pm-kes3/pm-6vy7/pm-hfli/pm-3l76/pm-p99b/pm-mo2v): documentation freshness + progressive disclosure, and CI/CD least-privilege hardening.
Docs freshness (Lane E, pm-p99b)
README.md,plugins/pm-claude/README.md(×3 sites),plugins/pm-claude/.claude-plugin/plugin.json,plugins/pm-claude/commands/pm-init.md; the plugin narrow-tool table gains the missingpm_next,pm_focus,pm_profilerows (27 narrow +pm_run), and the pm-init tool list now names all 28. Plugin version bumped 1.4.0 → 1.4.1.engines>=22.18.0):CONTRIBUTING.md,docs/ARCHITECTURE.md,docs/ONBOARDING.md.CONTRIBUTING.md: nowubuntu-latest(Node 22, 24) +macos-latest(Node 24), nightly for Windows/Node 25 — matchingci.yml.comments-audit/normalize(governance-audit) andtest-runs† (linked-test-adapters) footnoted indocs/COMMANDS.md; caveats added at first mention forreindex/normalize(AGENT_GUIDE),normalize(ONBOARDING),calendar(CONFIGURATION),reindex(ARCHITECTURE);pm completionsection notes it comes fromguide-shell.docs/EXTENSIONS.mdnow summarizes and links to the canonical matrix indocs/SDK.mdinstead of restating it (also keeps EXTENSIONS.md under its 450-line gate).docs/ONBOARDING.mdnow declaresAGENT_GUIDE.mdas the canonical loop source.pm install <path> --project,pm package --reload,pm package doctor), notingpm extension --installremains a compatibility form.docs/README.mdlinksAGENTS.md+PRD.md;docs/EXTENSIONS.mdfirst-party package list now links all 11 package READMEs.CI/CD hardening (Lane F, pm-mo2v)
auto-release.yml:actions: write→actions: read(gh run list/watchonly read run state).scripts/check-secrets-lib.mjs: newanthropic-api-key(sk-ant-…),openai-api-key(sk-…/sk-proj-…/sk-svcacct-…), andgitlab-token(glpat-…) rules + spec coverage; repo-wide scan stays clean.releaseenvironment now restricted by deployment branch policy tomain+v*.*.*tags (covers bothauto-release.ymlon main and tag-triggeredrelease.yml).secret_scanning_non_provider_patterns/secret_scanning_validity_checksrequire paid GitHub Secret Protection (PATCH is silently ignored on the free plan) — documented on pm-mo2v.Audit follow-ups filed (not in this PR)
@unbrained/pm-cliis unresolvablepm context/pm nexthot path ~700ms on an 857-item trackerVerification
pnpm build,pnpm typecheck,npx eslint .(zero output), docs-skills gate,node scripts/check-secrets.mjsclean, Claude-plugin smoke, full coverage suite green (see checks).pnpm changelog:pm:checkgreen after regeneration (audit-lane closes recorded under Unreleased).🤖 Generated with Claude Code
https://claude.ai/code/session_01FM3GimxcR6DpRdMiBX3RLs
Summary by cubic
Refreshes docs to match the current ecosystem (28 MCP tools, Node 22.18, package-provided commands) and hardens CI with least-privilege permissions and stronger secret scanning, including GitLab routable PATs. Keeps plugin/marketplace metadata in sync and trims duplicated docs.
Docs Freshness
README.md, plugin docs, and manifests; addedpm_next,pm_focus,pm_profile; bumpedpm-claudeto 1.4.1 in plugin and both marketplace manifests.CONTRIBUTING.md,docs/ARCHITECTURE.md, anddocs/ONBOARDING.md; aligned CI matrix docs toubuntu-latest(Node 22, 24) andmacos-latest(Node 24), with nightly Windows/Node 25.comments-audit/normalizefromgovernance-audit,test-runsfromlinked-test-adapters,pm completionfromguide-shell; notedreindex/normalize/calendarrequire packages (e.g.,search-advanced,governance-audit,calendar).EXTENSIONS.mdlinks to the canonical SDK matrix;ONBOARDING.mdpoints toAGENT_GUIDE.md; starter example uses package-first (pm install,pm package --reload,pm package doctor).CI/CD Hardening
auto-release.ymlpermissions toactions: read; updated the workflow contract test.sk-ant-), OpenAI (sk-incl.sk-proj-/sk-svcacct-with a negative lookahead to avoidsk-ant-), and GitLab (glpat-), now including routable PATs with dots.releaseenvironment tomainandv*.*.*tags via deployment branch policy.Written for commit 4b0926c. Summary will update on new commits.