Repository navigation
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1oSUnqwgyib756icLxZzz
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1oSUnqwgyib756icLxZzz
Implements PR 1 of the deps plugin plan: pure classification, metadata, sanitizer, write-guard and argument modules with scenario-driven tests built from real Dependabot captures, plus CI on Node 22 and LTS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1oSUnqwgyib756icLxZzz
Deny non-gh/git commands except read-only text filters, deny output redirection, guard the bare agent name, flatten the shell tokenizer into its own module, compute bumps once in classify, and enforce the purity and write-verb rules in the test suite. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1oSUnqwgyib756icLxZzz
12 of 13 tasks
Dependabot PR bodies carry no vulnerability section and no security label by default, so match the repo's open Dependabot alerts against each PR's bumps instead of scanning the body. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G1oSUnqwgyib756icLxZzz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
depsplugin (plugins/deps/scripts/lib/core/): GraphQL snapshot normalization, Dependabotupdated-dependenciesparsing with 0.x semver adjustment, per-fact classification intoattention/waiting/blocked/needs-analysis/routine, a comment sanitizer, the analyst write guard (default-deny allowlist of read-onlygh/gitcommands plus text filters, no output redirection), and strict CLI argument validation.test/deps/) built from trimmed realghcaptures (chore(deps): bump fast-json-stringify from 6.3.0 to 7.0.1 supabase/storage#1495, chore(deps): bump the github-actions group across 1 directory with 15 updates ROCm/rocm-libraries#13313, a Renovate PR) assert exact{bucket, facts}for every required scenario, plus security ordering, determinism, and source-rule tests that enforce core purity and the no-write-verb rule..github/workflows/ci.yml) runsnode --teston Node 22 and LTS and validates the marketplace and existing plugins with--strict. Noplugin.jsonyet, soplugins/depsis not a plugin until PR 2.Data-driven deviations from the plan's wording: provenance reads
web-flowfrom the commit signature (the committer isGitHub <noreply@github.com>) and pins Dependabot's numeric noreply email;mergeStateStatus: BLOCKEDis informational (normal under branch protection); security comes from the repo's open Dependabot alerts (an alert whose patched version is at or below the bump's new version) or asecuritylabel. Live testing showed Dependabot bodies carry no vulnerability section and no label by default.Plan
docs/plan/2026-10-09-feat-deps-triage-plugin-plan.md— PR 1 of 3 (Core and CI). Stacked: PR 2 builds on this branch.Test plan
node --test test/deps/*.test.mjspasses (Node 24 locally; Node 22 verified by the builder)source-rules.test.mjs)claude plugin validate --strictpasses for the marketplace,plugins/git,plugins/workflow🤖 Generated with Claude Code
https://claude.ai/code/session_01G1oSUnqwgyib756icLxZzz