@groeponline/pi-wishcraft 0.23.1 → 0.23.3

package/CHANGELOG.md

@@ -2,8 +2,23 @@
 
 ## [Unreleased]
 
+## [0.23.3] - 2026-08-20
+
+### Fixed
+- Nested settings writes reject `__proto__` / `constructor` / `prototype` keys in the assignment loop.
+- Test workflow pins `GITHUB_TOKEN` to `contents: read`.
+
+## [0.23.2] - 2026-08-20
+
+### Fixed
+- Release workflow creates a GitHub Release for each tag so the Releases page Latest matches npm.
+
 ## [0.23.1] - 2026-08-20
 
+### Fixed
+- Per-segment fault isolation: a throwing custom `command` segment shows `!id` instead of blanking the footer.
+- `open_ports` parses macOS netstat dot-separated local addresses (`*.5900`, `127.0.0.1.631`).
+
 ## [0.23.0] - 2026-08-20
 
 ### Added

package/RELEASE.md

@@ -20,11 +20,12 @@ verify it.
 **Default:** every merge to `main` is a release. `.github/workflows/release.yml`
 runs `node scripts/release.mjs auto --push` on `main` and publishes in that
 same job (`scripts/npm-publish.sh`) with the GroepOnline org secret
-`NPM_TOKEN`. A tag pushed with `GITHUB_TOKEN` does **not** start another
-workflow, so publish cannot wait for the tag event. Manual SSH/PAT tag
-pushes still run the tag job. `auto` reads commit subjects since the last
-`v*` tag: `feat:` → minor, `feat!:` / `BREAKING CHANGE` → major, otherwise
-patch.
+`NPM_TOKEN`, then creates a GitHub Release for the tag
+(`scripts/github-release.sh`) so the Releases page Latest matches npm. A tag
+pushed with `GITHUB_TOKEN` does **not** start another workflow, so publish
+cannot wait for the tag event. Manual SSH/PAT tag pushes still run the tag
+job. `auto` reads commit subjects since the last `v*` tag: `feat:` → minor,
+`feat!:` / `BREAKING CHANGE` → major, otherwise patch.
 
 The first merge after `v0.18.0` therefore becomes **0.19.0** (the 0.19
 `feat:` commits are already on `main`). Later docs/fix merges become
@@ -78,6 +79,7 @@ start a second run.
 7. `npm run verify:package` (catalog contract gate — see `scripts/verify-package.mjs`)
 8. `node scripts/release.mjs auto --push` (main only)
 9. `sh scripts/npm-publish.sh` with `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` (fail-closed `npm view`, idempotent skip, then the Pi catalog URLs)
+10. `sh scripts/github-release.sh` with `GITHUB_TOKEN` (idempotent: skip if that tag already has a Release; notes from `CHANGELOG.md`)
 
 `NPM_TOKEN` is the GroepOnline **org** Actions secret (publish rights to the
 `@groeponline` scope). This repo has no override; Actions inherits the org
@@ -109,10 +111,14 @@ gh run view <databaseId> --repo GroepOnline/pi-wishcraft \
 # 4. npm registry (published + propagated)
 npm view @groeponline/pi-wishcraft version        # 0.15.0
 npm view @groeponline/pi-wishcraft dist-tags      # { latest: '0.15.0' }
+
+# 5. GitHub Release Latest matches npm
+gh release list --repo GroepOnline/pi-wishcraft --limit 5
 ```
 
-A release is "done" when all four hold: local green, tag on origin, CI
-`success`, and `npm view` returns the new version.
+A release is "done" when all five hold: local green, tag on origin, CI
+`success`, `npm view` returns the new version, and GitHub Releases Latest
+is that same tag.
 
 ## Known gotchas
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groeponline/pi-wishcraft",
-  "version": "0.23.1",
+  "version": "0.23.3",
   "description": "Wishcraft cockpit for the pi coding agent — powerline status, vibes, idea inbox, bash mode, and full customization.",
   "type": "module",
   "files": [

package/src/extension/settings/wishcraft-config.ts

@@ -55,7 +55,44 @@ export function readConfigPath(settings: Record<string, unknown>, path: string):
   return null;
 }
 
-/** Genest schrijven (immutabel op elk niveau) + persist naar settings.json. */
+/** True for path segments that would mutate Object.prototype. */
+export function isUnsafeConfigKey(key: string): boolean {
+  return key === "__proto__" || key === "constructor" || key === "prototype";
+}
+
+/**
+ * Set `parts` (after the root key) on `root`. Returns false and leaves
+ * `root` unchanged when a segment is `__proto__`, `constructor`, or `prototype`.
+ */
+export function assignNestedConfigValue(
+  root: Record<string, unknown>,
+  parts: string[],
+  value: ConfigValue,
+): boolean {
+  for (const part of parts) {
+    if (part === "__proto__" || part === "constructor" || part === "prototype") {
+      return false;
+    }
+  }
+  let node = root;
+  for (let i = 0; i < parts.length; i++) {
+    const key = parts[i]!;
+    // Guard in this loop so CodeQL sees the key check next to the assignment.
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      return false;
+    }
+    if (i === parts.length - 1) {
+      if (value === null) delete node[key];
+      else node[key] = value;
+    } else {
+      if (!isRecord(node[key])) node[key] = {};
+      node = node[key] as Record<string, unknown>;
+    }
+  }
+  return true;
+}
+
+/** Nested write (new object per level) + persist to settings.json. */
 export function writeConfigPath(
   cwd: string,
   path: string,
@@ -63,29 +100,20 @@ export function writeConfigPath(
 ): boolean {
   const parts = path.split(".");
   const rootKey = parts[0]!;
-  // Weiger prototype-pollution keys (CodeQL).
-  if (parts.some((p) => p === "__proto__" || p === "constructor" || p === "prototype")) {
+  if (!rootKey || parts.some(isUnsafeConfigKey)) {
     return false;
   }
   return writeSettingKey(cwd, rootKey, (existing) => {
-    // Shorthand string onder powerline (bv. "chef") is een preset-naam: bewaar 'm.
-    let node: Record<string, unknown> = isRecord(existing)
+    // Shorthand string under powerline (e.g. "chef") is a preset name: keep it.
+    const node: Record<string, unknown> = isRecord(existing)
       ? existing
       : rootKey === "powerline" && typeof existing === "string"
         ? { preset: existing }
         : {};
-    const root = node;
-    for (let i = 1; i < parts.length; i++) {
-      const key = parts[i]!;
-      if (i === parts.length - 1) {
-        if (value === null) delete node[key];
-        else node[key] = value;
-      } else {
-        if (!isRecord(node[key])) node[key] = {};
-        node = node[key] as Record<string, unknown>;
-      }
+    if (!assignNestedConfigValue(node, parts.slice(1), value)) {
+      return existing;
     }
-    return root;
+    return node;
   });
 }