Sync the public tree to plugins 0.6.1 and evercli v0.32.0 - #11
Merged
Conversation
- Sync the plugin workspaces with the published 0.6.1 packages and open-source four more host plugins: kimicode, cursor, devin, and dsh (DeepSeek Harness), each with its own test suite in the workspace. - Refresh the Codex marketplace plugin to 0.6.1. The marketplace reads this repository directly, so Codex users only receive a lifecycle Hook runner update when it lands here — the npm releases alone never reached them. The bundled bin/hook.mjs rebuilds byte-identical to the runner on npm. - Sync the cli/ Go tree to the evercli v0.32.0 release: the skill subcommand, plugin uninstall, the import conversations pipeline with --async bulk mode, and installers for eight more hosts. Format with gofmt and tidy go.mod. - Ship cli/.goreleaser.yml so the released binaries are reproducible from this tree, and correct its release-notes header, which still described the distribution as closed-source. - Carry this repository's two curated patches across the sync: the httpmock mutex that keeps `go test -race ./...` a usable gate, and the workspace dependency overrides that keep npm audit clean. Pin hono, fast-uri, and ip-address to patched floors for advisories arriving through @modelcontextprotocol/sdk. - Extend the CI manifest check to every workspace and exempt the import redactor from the private-key scan: it carries the PEM header pattern because stripping that pattern is its job. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Three release channels ship EverMe, but only one of them reads this repository:
@everme/{agent-sdk,memory-mcp,openclaw,claude-code,codex}@everme/clieverclibinariesevercliresolves the Codex marketplace toEverMind-AI/EverMeand Codexinstalls read
plugins/everme/straight out of the repository — they nevertouch npm. So publishing 0.6.1 to npm did nothing for Codex users: their
lifecycle Hook runner stayed on the 0.4.2 bundle. Landing this PR is the
release action for that channel. The plugin version moves 0.4.2 → 0.6.1, so
codex plugin marketplace upgradetriggers normally without a remove/add.What
@everme/kimicode,@everme/cursor,@everme/devin,@everme/dsh.cli/Go tree → evercli v0.32.0. The released binaries were alreadypublic while the source here trailed them; this closes that gap. Brings the
skillsubcommand,plugin uninstall, theimport conversationspipelinewith
--asyncbulk mode, and installers for eight more hosts.cli/.goreleaser.ymladded so the published binaries are reproduciblefrom this tree. Its release-notes header still called the distribution
closed-source; corrected.
hono,fast-uri, andip-address, pinnedthrough workspace
overridesfor advisories arriving via@modelcontextprotocol/sdk. Published package manifests are untouched —every pin sits inside its consumer's declared range.
is exempted from the private-key scan, since carrying the PEM header
pattern is exactly what a PEM redactor does.
Two patches that exist only in this repository were re-applied on top of the
synced sources rather than lost to the overwrite: the
httpmockmutex thatkeeps
go test -race ./...a usable gate, and the workspace dependencyoverrides behind
npm audit.Verification
Every gate this repository's CI runs was run locally first:
go build/go vet/gofmt -lgo mod tidydiffcharmbracelet/*mislabeled indirect)go test -race -count=1 ./...make build+--versionsmokenpm ci+npm test --workspacesnpm audit --audit-level=moderateplugins/everme/bin/hook.mjsrebuilt from source in this tree hashesidentically to the runner published on npm, so Codex users and npm users get
the same bytes.