fix(release): close the adversarial review findings before 3.0.0 ships - #23
Merged
Merged
Conversation
Two independent reviewers (Claude + Codex) attacked main; no P0, seven P1s. All fixed here with tests: navigation (summer_open / summer open) - refuse to open a browser on any origin that is not summerengine.com, a subdomain, or loopback — a gateway.url / SUMMER_GATEWAY_URL pointing at summerengine.com.evil.com opened there before (blocked_origin) - refuse res:// paths that escape the project (.., backslashes, percent escapes, leading slash) both as targets and as path/scene params - a failed browser launch is a structured open_failed result carrying the url, not a thrown error out of the MCP tool - `summer open /pricing` reaches navigation (known web paths), an exact map id beats a same-named directory in cwd (`./billing` still means the folder) - unmapped paths: returnUrl/redirect/next-style query params must be relative (no open redirect through the login page); long targets are truncated in hints upgrade path - plugin manifests (.mcp.json, gemini-extension.json, plugin.json for Claude/Codex/Cursor) launch `npx -y summer-engine@latest mcp` — the bare `npx summer-engine mcp` hung on non-TTY hosts and served stale caches - `summer setup --force` prunes the skills 2.8.x installed that v3 retired (summer-cloud, un-prefixed vfx recipes, ...) so no host keeps a skill that calls removed tools; only dirs with a SKILL.md, only names absent from the current registry (src/installer/legacy-skills.ts) - refresh hints follow the channel: a CLI ahead of npm latest (installed from `next`) defaults `summer setup` to `--channel next` and doctor recommends `@next --channel next`, instead of downgrading the MCP server to latest docs: CHANGELOG folds the stray "Unreleased" item into 3.0.0 and fixes the skill count (94); RELEASE-3.0.0.md and using-summer describe the channel rule. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent reviews (Claude + Codex) of main: no P0, seven P1s, all fixed with tests. Details in the commit message. Gates: 1452 tests, validate-library 0 errors, registry --check no drift, eval:routing PASS, scratch-HOME smoke of each repro.
🤖 Generated with Claude Code