Zy Deng 4c60879b5d fix(#4132): verify durable runtime surface sources (#4182) ...

* fix(#4132): verify durable runtime surface sources

* chore(#4132): record PR number in changeset

* test(#4132): cover rejected commands source alias

* fix(#4132): reject aliased package fallback

* test(#4132): cover rejected agents source alias

* test(#4132): cover partially aliased marker provider

* fix(#4132): reject partially aliased source providers

* test(#4132): cover routed source identity probes

* fix(#4132): route installed source identity probes

* refactor(#4132): tighten installer source metadata

* test(#4132): cover corpus trust boundary attacks

* fix(#4132): close installed corpus trust gaps

* refactor(#4132): keep installer authority private

* fix(#4132): preserve private installer fallback

* test(#4132): preserve fixture source authority

* fix(#4132): reject overlapping source fallback

* fix(#4132): avoid redundant installed corpus reads

* refactor(#4132): simplify provider resolution

* test(#4132): sync install tree fixtures after rebase

---------

Co-authored-by: Tom Boucher <trekkie@nomorestars.com>

2026-09-05 15:32:52 -04:00

..

adversarial

enhance(#3881): one YAML parser — vendored js-yaml replaces the hand-rolled dialect (#3888)

2026-08-26 19:29:32 -04:00

base64-locale

fix(116): locale-safe base64-scan with portable timeout and partial-scan signaling (#132)

2026-05-23 10:14:48 -04:00

brand-typing

enhance(#2671): brand raw vs calibrated token types so double-application is a compile error (#2676)

2026-07-26 21:42:50 -04:00

check-env

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

fallow

fix(#1012): invoke fallow with its real CLI and wire the report normalizer (#1044)

2026-06-11 11:36:50 -04:00

golden

enhance(#3881): one YAML parser — vendored js-yaml replaces the hand-rolled dialect (#3888)

2026-08-26 19:29:32 -04:00

install-tree

fix(#4132): verify durable runtime surface sources (#4182)

2026-09-05 15:32:52 -04:00

live-command-registry

test: replace deny-list parity tests with polarity-inverted live-registry (#3049) (#3284)

2026-05-09 02:49:19 -04:00

npm-integrity

feat(114): npm dependency integrity gate (npm ls invalid/extraneous) (#135)

2026-05-23 15:50:17 -04:00

prompt-budget-parity

chore(#2929): generalize prompt-budget into the shared context-composer seam (#2958)

2026-07-31 23:03:13 -04:00

representative

fix(#2365): stop api-coverage detector false-positiving non-API phases (#2397)

2026-07-19 14:59:25 -04:00

index.cjs

enhance(#2872): record scope and runtime in the install manifest (#3323)

2026-08-10 15:50:55 -04:00

pi-host-plugin.cjs

feat(#2102): make pi a first-class installable runtime + fix its dispatch (ADR-1239)

2026-07-11 21:07:38 -04:00

plugin-manifest-schema.json

fix(#3029): remove redundant hooks declaration from plugin manifest (#3113)

2026-08-06 06:14:58 -04:00

vscode-host-binding.cjs

feat(#2103): drive VS Code through the Embeddable Orchestration System (ADR-1239)

2026-07-11 23:24:42 -04:00