Repository navigation
feat: lead with the security-review wedge, name the marketplace vib795 (0.6.0) - #34
Conversation
…5 (0.6.0) The README buried the one thing that distinguishes this package. "Using nothing an IT security review would need to approve" was a subordinate clause under seven badges, and Install sat at line 378 of 784 -- a visitor scrolled past 377 lines before learning how to install anything. Both are now the first screen: the zero-dependency, no-install-script, independently-scanned argument is the headline, install is at line 14, and the badges moved below the fold. The rewrite also corrects a relationship the old first screen never stated. The Claude Code plugin carries the skills; npm carries the store. Presenting them as peer install paths sends plugin-only users into three prompts with no memory behind them, which is worse than no shortcut at all. The marketplace is renamed from agent-memory to vib795, so the install command reads `/plugin install agent-memory@vib795` rather than `agent-memory@agent-memory`, which read like a typo. The plugin slug itself is unchanged, and the timing is deliberate: a marketplace entry's name is an immutable slug once a directory lists it, because users have it installed under that name. Nothing lists this yet, so the rename is free today and impossible later. package-lock.json had drifted to 0.1.4 and stayed there through the eighteen releases after it. The parity test that catches exactly this for plugin.json and marketplace.json never read the lock file, so the same silent drift it was written to prevent happened one file over. It now asserts both copies of the version the lock carries, checked for teeth by reverting the lock and confirming the failure names package-lock.json. 91 tests, still no dependencies. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe release updates package metadata to version 0.6.0, changes the marketplace package name to ChangesRelease metadata and manifest validation
Estimated code review effort: 2 (Simple) | ~10 minutes Mergeability Score: ⚪ Minimal · up to The PR updates README positioning and package metadata; the only identified issue is a minor README formatting fix, with no merge-blocking product or production risk. Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Line 29: Update the fenced code block beginning at the affected README section
to specify the text language as text, preserving the existing Claude Code slash
commands and block contents.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f00880b4-9110-417f-b0f5-1ec6c06971c9
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
.claude-plugin/marketplace.json.claude-plugin/plugin.jsonREADME.mdpackage.jsontest/integration.test.js
| In Claude Code you can take the three skills as a plugin instead of letting `setup` | ||
| link them: | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a language to the new fenced block.
README.md Line 29 starts a fenced code block without a language. markdownlint-cli2 reports MD040 for this line. Use text for the Claude Code slash commands.
Proposed fix
-```
+```text📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 29-29: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 29, Update the fenced code block beginning at the affected
README section to specify the text language as text, preserving the existing
Claude Code slash commands and block contents.
Source: Linters/SAST tools
Positioning fixes on the README's first screen, a marketplace rename that has to happen before any directory lists this, and a version-drift hole the parity test missed.
The README buried its own argument
"Using nothing an IT security review would need to approve" is the one claim that separates this from the dozen functionally identical packages on npm. It was a subordinate clause, under seven badges.
Worse, Install was at line 378 of 784. A visitor scrolled past 377 lines before learning how to install anything.
The first screen now leads with the zero-dependency / no-install-script / independently-scanned argument, puts Install at line 14, and moves the badges below the fold.
One correction the old first screen never made
The Claude Code plugin carries the skills;
npmcarries the store. A first draft of this change presented them as peer install paths, which would have sent every plugin-only user into three prompts with no memory behind them — worse than not offering the shortcut. The section now leads withnpmand frames the plugin as a skills-delivery option, matching what the detailed Install section has always said.agent-memory@agent-memory→agent-memory@vib795The marketplace and the plugin were both named
agent-memory, so the install command read like a typo:Only the marketplace name changes. The plugin slug stays
agent-memory.The timing is the point. From the official directory's own documentation:
No directory lists this yet, so the rename is free today and impossible after the first listing.
The parity test had a hole one file wide
package-lock.jsonsat at 0.1.4 through the eighteen releases after it.The test at
test/integration.test.js:1112exists specifically to catch this class of drift — it was written afterplugin.jsonandmarketplace.jsondrifted for fifteen releases. It never read the lock file, so the exact failure it was written to prevent happened one file over, silently, the whole time.package.json.claude-plugin/plugin.json.claude-plugin/marketplace.jsonpackage-lock.jsonThe test now asserts both copies of the version the lock carries — npm writes the root and
packages[""]together, but only the root one is obvious.Checked for teeth: reverting the lock to 0.1.4 fails with
AssertionError: package-lock.json, and restoring it passes. A parity assertion that cannot fail is the reason this drifted in the first place.Why a minor bump
The documented install command changes, so this is not a patch. 91 tests, zero runtime and zero dev dependencies, unchanged.
Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Summary by CodeRabbit
vib795.