📦 deps(thirdparty): update snapshots

This commit is contained in:
ci[bot]
2026-07-20 00:03:02 +00:00
parent 47ce7f78dc
commit 2c00adccd5
1216 changed files with 10376 additions and 90058 deletions
@@ -39,11 +39,8 @@ This document summarizes the repository coherence audit performed after the `app
- missing examples and missing limitations sections,
- overly long `SKILL.md` files that should probably be split into `references/`,
- plus the existing structural/safety checks (frontmatter, risk, `When to Use`, offensive disclaimer, dangling links).
- The report also includes a non-blocking `suggested_risk` for skills that are still marked `unknown` or appear to be misclassified, so maintainers can resolve risk classification during PR review without changing the contributor gate.
- Added `tools/scripts/sync_risk_labels.py` (also exposed as `npm run sync:risk-labels`) for conservative legacy cleanup: it only rewrites `risk: unknown` when the suggestion is high-confidence enough to be safely automated.
- The sync now covers explicit high-confidence `safe`, `critical`, `offensive`, and `none` patterns. When a skill is promoted to `offensive`, the sync also inserts the canonical `AUTHORIZED USE ONLY` notice so the label and content guardrail stay aligned.
- The intended maintainer loop is: `audit:skills` to inspect `suggested_risk`, `sync:risk-labels` for the safe automated subset, then manual review for the ambiguous tail that should not be batch-classified.
- Use `npm run audit:skills` for the maintainer view and `npm run audit:skills -- --json-out ... --markdown-out ...` when you want artifacts for triage or cleanup tracking.
- Risk inference from isolated words was removed because it produced widespread false positives. The audit validates declared metadata; ambiguous labels require semantic review.
- Use `npm run audit:skills` for the maintainer view and `npm run audit:skills -- --json-out ... --markdown-out ...` when you want objective structural artifacts for triage or cleanup tracking.
### 3. Cross references
@@ -79,8 +76,6 @@ This document summarizes the repository coherence audit performed after the `app
npm run validate # skill validation (soft)
npm run validate:strict # hardening / diagnostic pass
npm run audit:skills # full skill audit with finding codes and status
npm run sync:risk-labels # conservative sync for high-confidence legacy risk labels
npm run sync:risk-labels -- --dry-run # preview legacy risk rewrites before touching files
npm run validate:references # workflow, bundle, and docs/users/bundles.md references
npm run security:docs # documentation command-risk scan (required for security-sensitive guidance)
npm run build # chain + catalog
@@ -90,5 +85,5 @@ npm test # suite test
## Open issues / follow-up
- Gradual cleanup of legacy skills so `npm run validate:strict` can become a hard CI gate in the future.
- Continue reducing the remaining `risk: unknown` tail with conservative sync passes plus manual maintainer review for ambiguous cases.
- Continue reducing the remaining `risk: unknown` tail through semantic maintainer review.
- Keep translated docs aligned in a separate pass after the canonical English docs are stable.