@rse/ase 0.9.14 → 0.9.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/plugin/.claude-plugin/plugin.json +1 -1
- package/plugin/.codex-plugin/plugin.json +1 -1
- package/plugin/.github/plugin/plugin.json +1 -1
- package/plugin/package.json +1 -1
- package/plugin/skills/ase-code-analyze/SKILL.md +94 -1
- package/plugin/skills/ase-task-condense/SKILL.md +1 -1
- package/plugin/skills/ase-task-edit/SKILL.md +2 -1
- package/plugin/skills/ase-task-grill/SKILL.md +1 -1
- package/plugin/skills/ase-task-preflight/SKILL.md +2 -1
- package/plugin/skills/ase-task-reboot/SKILL.md +1 -1
package/package.json
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
"homepage": "http://github.com/rse/ase",
|
|
7
7
|
"repository": { "url": "git+https://github.com/rse/ase.git", "type": "git" },
|
|
8
8
|
"bugs": { "url": "http://github.com/rse/ase/issues" },
|
|
9
|
-
"version": "0.9.
|
|
9
|
+
"version": "0.9.16",
|
|
10
10
|
"license": "GPL-3.0-only",
|
|
11
11
|
"author": {
|
|
12
12
|
"name": "Dr. Ralf S. Engelschall",
|
package/plugin/package.json
CHANGED
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
"homepage": "http://github.com/rse/ase",
|
|
7
7
|
"repository": { "url": "git+https://github.com/rse/ase.git", "type": "git" },
|
|
8
8
|
"bugs": { "url": "http://github.com/rse/ase/issues" },
|
|
9
|
-
"version": "0.9.
|
|
9
|
+
"version": "0.9.16",
|
|
10
10
|
"license": "GPL-3.0-only",
|
|
11
11
|
"author": {
|
|
12
12
|
"name": "Dr. Ralf S. Engelschall",
|
|
@@ -89,6 +89,27 @@ problems in *performance* and *efficiency*, or problems in *security*.
|
|
|
89
89
|
- many I/O and query round-trips
|
|
90
90
|
- concurrency bottlenecks
|
|
91
91
|
- mismatched data structures
|
|
92
|
+
- N+1 query patterns (1 parent query, N child queries)
|
|
93
|
+
- missing caching/memoization of stable results
|
|
94
|
+
- blocking/synchronous calls on hot paths
|
|
95
|
+
- unbounded growth (memory leaks, ever-growing collections)
|
|
96
|
+
- inefficient string building/concatenation in loops
|
|
97
|
+
- premature or repeated serialization/parsing
|
|
98
|
+
- lack of batching/pagination for bulk operations
|
|
99
|
+
- excessive logging or instrumentation overhead
|
|
100
|
+
- chatty network protocols (no connection pooling/keep-alive)
|
|
101
|
+
- lock contention and overly coarse-grained locking
|
|
102
|
+
- eager/over-fetching of data that is never used
|
|
103
|
+
- missing database indexes
|
|
104
|
+
- repeated regex (re)compilation in hot paths
|
|
105
|
+
- busy-waiting/polling instead of event-driven waits
|
|
106
|
+
- transferring uncompressed or overly verbose payloads
|
|
107
|
+
- missing short-circuit evaluation in expensive conditions
|
|
108
|
+
- recomputing invariants inside loops (loop-invariant code)
|
|
109
|
+
- suboptimal batch sizes (too small = overhead, too large = latency)
|
|
110
|
+
- inefficient algorithms for sorting/searching already-ordered data
|
|
111
|
+
- redundant validation/sanitization of trusted internal data
|
|
112
|
+
- missing connection/resource reuse (open-close per operation)
|
|
92
113
|
- [...]
|
|
93
114
|
|
|
94
115
|
</if>
|
|
@@ -107,6 +128,35 @@ problems in *performance* and *efficiency*, or problems in *security*.
|
|
|
107
128
|
- unsafe cryptography
|
|
108
129
|
- hard-coded secrets
|
|
109
130
|
- vulnerable dependencies
|
|
131
|
+
- injection flaws
|
|
132
|
+
- cross-site scripting (XSS) and output-encoding gaps
|
|
133
|
+
- cross-site request forgery (CSRF) and missing anti-forgery tokens
|
|
134
|
+
- insecure direct object references (IDOR)
|
|
135
|
+
- server-side request forgery (SSRF)
|
|
136
|
+
- insecure or missing transport encryption (TLS)
|
|
137
|
+
- weak session management (fixation, predictable tokens)
|
|
138
|
+
- missing rate limiting/anti-automation controls
|
|
139
|
+
- overly permissive CORS or file permissions
|
|
140
|
+
- verbose error messages leaking internals
|
|
141
|
+
- unsafe randomness for security-sensitive values
|
|
142
|
+
- mass assignment / over-binding of request parameters
|
|
143
|
+
- security misconfiguration (default credentials, debug modes, exposed admin endpoints)
|
|
144
|
+
- missing or misconfigured security headers (CSP, HSTS, X-Frame-Options)
|
|
145
|
+
- improper certificate/hostname validation (TLS verification disabled)
|
|
146
|
+
- insufficient logging and monitoring of security events
|
|
147
|
+
- race conditions / TOCTOU (time-of-check to time-of-use) flaws
|
|
148
|
+
- integer overflow/underflow and buffer overflows
|
|
149
|
+
- use-after-free and memory-safety violations
|
|
150
|
+
- privilege escalation through improper privilege dropping
|
|
151
|
+
- insecure file upload handling (unrestricted type/size, executable storage)
|
|
152
|
+
- unsafe handling of untrusted regular expressions (ReDoS)
|
|
153
|
+
- caching of sensitive data in shared or client-side caches
|
|
154
|
+
- secrets or sensitive data leaking into logs, traces, or telemetry
|
|
155
|
+
- insecure default-deny failures (fail-open instead of fail-closed)
|
|
156
|
+
- missing integrity verification (unsigned updates, no subresource integrity)
|
|
157
|
+
- excessive data exposure in API responses (returning more fields than needed)
|
|
158
|
+
- improper resource cleanup leading to exhaustion (connection/file-descriptor leaks)
|
|
159
|
+
- business-logic flaws (bypassable workflows, negative quantities, replay)
|
|
110
160
|
- [...]
|
|
111
161
|
|
|
112
162
|
</if>
|
|
@@ -130,6 +180,48 @@ problems in *performance* and *efficiency*, or problems in *security*.
|
|
|
130
180
|
- null/undefined mishandling
|
|
131
181
|
- type-coercion bugs
|
|
132
182
|
- faulty parsing or merge/override semantics
|
|
183
|
+
- race conditions and unsynchronized shared state
|
|
184
|
+
- resource leaks (unclosed files, handles, connections)
|
|
185
|
+
- inverted or swapped function arguments
|
|
186
|
+
- incorrect loop termination or accumulator initialization
|
|
187
|
+
- shadowed or reassigned variables changing intent
|
|
188
|
+
- incomplete switch/case or enum coverage
|
|
189
|
+
- silent exception swallowing
|
|
190
|
+
- floating-point comparison and rounding errors
|
|
191
|
+
- integer overflow/underflow or truncating division
|
|
192
|
+
- sign and modulo errors with negative operands
|
|
193
|
+
- reference vs. value semantics (aliasing, shared mutable defaults)
|
|
194
|
+
- incorrect short-circuit evaluation or operator precedence
|
|
195
|
+
- logical vs. bitwise operator confusion
|
|
196
|
+
- negation mistakes in compound predicates
|
|
197
|
+
- wrong comparison operator (`==` instead of `===`, `<` vs. `<=`, etc)
|
|
198
|
+
- inverted condition or swapped if/else branches
|
|
199
|
+
- dead or duplicated conditional branches
|
|
200
|
+
- fall-through where a break or return was intended
|
|
201
|
+
- missing or misplaced base case in recursion (non-termination)
|
|
202
|
+
- mutation of a collection while iterating over it
|
|
203
|
+
- incorrect index, key, or bounds when accessing collections
|
|
204
|
+
- empty-collection or single-element edge cases unhandled
|
|
205
|
+
- wrong order of operations in initialization or teardown
|
|
206
|
+
- missing cleanup on early return, break, or exception path
|
|
207
|
+
- double-free, use-after-free, or double-close of resources
|
|
208
|
+
- incorrect time-zone, date arithmetic, or unit conversions
|
|
209
|
+
- stale cache or memoization not invalidated on change
|
|
210
|
+
- incorrect deep vs. shallow copy semantics
|
|
211
|
+
- partial or non-atomic updates leaving inconsistent state
|
|
212
|
+
- ignored or unchecked return values and status codes
|
|
213
|
+
- error code vs. exception path mismatch
|
|
214
|
+
- catching too broad an exception masking real failures
|
|
215
|
+
- re-throwing without preserving the original cause
|
|
216
|
+
- incorrect equality, hashing, or ordering for custom types
|
|
217
|
+
- regex anchoring, greediness, or escaping mistakes
|
|
218
|
+
- string encoding, normalization, or case-folding errors
|
|
219
|
+
- missing `await` causing unhandled or dropped promises
|
|
220
|
+
- incorrect promise concurrency (`all` vs. `allSettled`, races)
|
|
221
|
+
- callback invoked zero times, twice, or out of order
|
|
222
|
+
- unguarded re-entrancy or recursive lock acquisition
|
|
223
|
+
- incorrect guard ordering allowing invalid states through
|
|
224
|
+
- assumptions about iteration order of maps/sets/objects
|
|
133
225
|
- [...]
|
|
134
226
|
|
|
135
227
|
</if>
|
|
@@ -154,7 +246,8 @@ problems in *performance* and *efficiency*, or problems in *security*.
|
|
|
154
246
|
dropped, skip the per-problem report but still purge any stale
|
|
155
247
|
persisted problems with a *single* `ase_kv_batch` call to the `ase`
|
|
156
248
|
MCP server with `transactional` set to `true` and a `commands`
|
|
157
|
-
parameter array holding exactly one `{ command: "clear"
|
|
249
|
+
parameter array holding exactly one `{ command: "clear", prefix:
|
|
250
|
+
"ase-issue-" }` entry,
|
|
158
251
|
and still emit the final hint <template/> below.
|
|
159
252
|
|
|
160
253
|
In this STEP 3, for *EVERY* surviving problem, immediately report
|
|
@@ -93,7 +93,7 @@ explicitly requested by this procedure via outputs based on a <template/>!
|
|
|
93
93
|
Set <words-before><words/></words-before> (remember the loaded
|
|
94
94
|
word count for the strictly-smaller check in step 3).
|
|
95
95
|
|
|
96
|
-
<if condition="<content/> contains 'Created: <text/>'">
|
|
96
|
+
<if condition="<content/> contains '⎈ Created: <text/>'">
|
|
97
97
|
Set <timestamp-created><text/></timestamp-created> (extract the
|
|
98
98
|
original creation timestamp so it can be re-inserted unchanged
|
|
99
99
|
into the condensed <content/> in step 3).
|
|
@@ -320,7 +320,8 @@ Set <content-dirty>true</content-dirty>.
|
|
|
320
320
|
ISO-style format, which has to be determined by calling the
|
|
321
321
|
`ase_timestamp(format: "yyyy-LL-dd HH:mm")` tool of the `ase`
|
|
322
322
|
MCP server and use the `text` field of its response. Update
|
|
323
|
-
<content/> with the new
|
|
323
|
+
the `⚙ Modified: ...` line of <content/> with the new
|
|
324
|
+
`⚙ Modified: <timestamp-modified/>`.
|
|
324
325
|
Do not output anything.
|
|
325
326
|
</if>
|
|
326
327
|
|
|
@@ -213,7 +213,7 @@ explicitly requested by this procedure via outputs based on a <template/>!
|
|
|
213
213
|
|
|
214
214
|
2. Finally, update the plan in <plan/> based on all answers <answer-N/>.
|
|
215
215
|
|
|
216
|
-
3. <if condition="<plan/> contains 'Created: <text/>'">
|
|
216
|
+
3. <if condition="<plan/> contains '⎈ Created: <text/>'">
|
|
217
217
|
Set <timestamp-created><text/></timestamp-created> (set
|
|
218
218
|
timestamp-created to extracted text)
|
|
219
219
|
</if>
|
|
@@ -162,7 +162,8 @@ explicitly requested by this procedure via outputs based on a <template/>!
|
|
|
162
162
|
ISO-style format, which has to be determined by calling the
|
|
163
163
|
`ase_timestamp(format: "yyyy-LL-dd HH:mm")` tool of the `ase`
|
|
164
164
|
MCP server and use the `text` field of its response. Update
|
|
165
|
-
<content/> with the new
|
|
165
|
+
the `⚙ Modified: ...` line of <content/> with the new
|
|
166
|
+
`⚙ Modified: <timestamp-modified/>`.
|
|
166
167
|
Do not output anything.
|
|
167
168
|
</if>
|
|
168
169
|
|
|
@@ -124,7 +124,7 @@ explicitly requested by this procedure via outputs based on a <template/>!
|
|
|
124
124
|
(append extracted text to instruction).
|
|
125
125
|
</if>
|
|
126
126
|
|
|
127
|
-
6. <if condition="<content/> contains 'Created: <text/>'">
|
|
127
|
+
6. <if condition="<content/> contains '⎈ Created: <text/>'">
|
|
128
128
|
Set <timestamp-created><text/></timestamp-created> (set
|
|
129
129
|
timestamp-created to extracted text)
|
|
130
130
|
</if>
|