Repository navigation
chore(release): 26.11.2 - #5
Merged
Merged
Conversation
dev ci --run --resume kept every non-test step when only documents changed, including the secret scan, the filesystem scan and the docs checks, whose results a document can change (a leaked key in a README, a broken link). Steps that read every file (gitleaks, trivy, semgrep, osv-scanner, markdownlint, vale, lychee, dev docs check, dev sec scan and similar) now rerun after any change; builds and code linters keep the docs shortcut.
The Stop hook asked a session to run dev plan revise for every plan changed since it started, in any project. With two sessions open (here devkit in the terminal and kit-consulting in Claude Desktop), it sent the devkit session back over kit-consulting's plan, a plan it must not touch. The check now covers the plans of the project the session works in, found from where it is now, and every plan only for a session outside any project. The handoff check shares the same project lookup.
devkit 26.11.2: a security policy with private vulnerability reporting and a contributing guide for the public repository, the real release flow in Developing devkit, and three fixes: dev agents test reads its log from the right offset, dev ci --run --resume reruns file-wide scans after a docs-only change, and the Stop hook checks only the session's own project's plans. VERSION and the plugin, Codex plugin and Claude Desktop manifests move to 26.11.2.
dev doctor passed ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md when they carried devkit's marker, and the Codex crew roles when the files existed, so an install from an older devkit looked current on both agents. It now compares each file with what this checkout writes (the instructions, and each role's exact text, shared with the writer) and names what is out of date.
plugin_copy_stale compared the last folder in text order, where 26.11.10 sorts before 26.11.2, so from PATCH 10 on the check would compare an old copy and report Claude Code's and Codex's plugin as current or stale wrongly. Folders are ordered by their version numbers now.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
devkit 26.11.2. It ships the public-repository documents merged in #4 and three fixes found while verifying 26.11.1. All of them are integrated on one branch, so CI runs once.
Changes
main:SECURITY.mdwith private vulnerability reporting,CONTRIBUTING.md, the real release flow in Developing devkit, and the self-test log offset fix.fix(ci):dev ci --run --resumereruns the steps that read every file (secret, filesystem and docs scans) after a docs-only change, because a document can leak a key too. Builds and code linters keep the docs shortcut.fix(hooks): the Stop hook asks fordev plan reviseonly for the plans of the session's own project. With devkit open in the terminal and kit-consulting in Claude Desktop, it had sent the devkit session back over kit-consulting's plan.fix(doctor):dev doctorcompares the installed~/.claude/CLAUDE.md,~/.codex/AGENTS.mdand the Codex crew roles with what this devkit writes. An install from an older devkit now shows as out of date on both agents, instead of passing because the files exist.fix(doctor): the installed-plugin check picks the newest copy by version number (26.11.10 is newer than 26.11.2), not by text.chore(release): VERSION, the three manifests and the CHANGELOG section for 26.11.2.How to verify
4011e5cand4e9fd8cbefore the last commits.dev ci --runpassed in full (evidence for treea466103).dev docs check0/0/0,dev stubs --allanddev test auditclean,dev crew sync --check26/26,claude plugin validatepasses.dev test prove).Risk and rollback
Links
v26.11.1); docs: docs: add a security policy and a contributing guide #4; self-test fix: fix(agents): read the self-test's log from its byte offset #3.