claudeos-core 2.3.1 → 2.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +1460 -73
- package/CODE_OF_CONDUCT.md +15 -0
- package/README.de.md +321 -883
- package/README.es.md +322 -883
- package/README.fr.md +322 -883
- package/README.hi.md +322 -883
- package/README.ja.md +322 -883
- package/README.ko.md +322 -882
- package/README.md +321 -883
- package/README.ru.md +322 -885
- package/README.vi.md +322 -883
- package/README.zh-CN.md +321 -881
- package/SECURITY.md +51 -0
- package/bin/commands/init.js +570 -264
- package/content-validator/index.js +185 -12
- package/health-checker/index.js +44 -10
- package/package.json +92 -90
- package/pass-json-validator/index.js +58 -7
- package/pass-prompts/templates/angular/pass3.md +15 -14
- package/pass-prompts/templates/common/claude-md-scaffold.md +203 -20
- package/pass-prompts/templates/common/pass3-footer.md +297 -56
- package/pass-prompts/templates/common/pass3a-facts.md +48 -3
- package/pass-prompts/templates/common/pass4.md +78 -40
- package/pass-prompts/templates/java-spring/pass1.md +54 -0
- package/pass-prompts/templates/java-spring/pass3.md +20 -19
- package/pass-prompts/templates/kotlin-spring/pass1.md +45 -0
- package/pass-prompts/templates/kotlin-spring/pass3.md +24 -23
- package/pass-prompts/templates/node-express/pass3.md +18 -17
- package/pass-prompts/templates/node-fastify/pass3.md +11 -10
- package/pass-prompts/templates/node-nestjs/pass3.md +11 -10
- package/pass-prompts/templates/node-nextjs/pass3.md +18 -17
- package/pass-prompts/templates/node-vite/pass3.md +11 -10
- package/pass-prompts/templates/python-django/pass3.md +18 -17
- package/pass-prompts/templates/python-fastapi/pass3.md +18 -17
- package/pass-prompts/templates/python-flask/pass3.md +9 -8
- package/pass-prompts/templates/vue-nuxt/pass3.md +9 -8
- package/plan-installer/domain-grouper.js +45 -5
- package/plan-installer/index.js +34 -1
- package/plan-installer/pass3-context-builder.js +14 -0
- package/plan-installer/scanners/scan-frontend.js +2 -1
- package/plan-installer/scanners/scan-java.js +98 -2
- package/plan-installer/source-paths.js +242 -0
- package/plan-installer/stack-detector.js +522 -42
package/SECURITY.md
ADDED
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported Versions
|
|
4
|
+
|
|
5
|
+
| Version | Supported |
|
|
6
|
+
|---------|--------------------|
|
|
7
|
+
| 2.4.x | :white_check_mark: |
|
|
8
|
+
| < 2.4 | :x: |
|
|
9
|
+
|
|
10
|
+
Only the latest minor release line receives security fixes. Users on older versions are encouraged to upgrade.
|
|
11
|
+
|
|
12
|
+
## Reporting a Vulnerability
|
|
13
|
+
|
|
14
|
+
**Please do not file public GitHub issues for security vulnerabilities.**
|
|
15
|
+
|
|
16
|
+
Two private channels are available:
|
|
17
|
+
|
|
18
|
+
1. **Email** — `claudeoscore@gmail.com`
|
|
19
|
+
2. **GitHub Security Advisories** — [Open a private report](https://github.com/claudeos-core/claudeos-core/security/advisories/new) (preferred; provides a private workspace + CVE coordination)
|
|
20
|
+
|
|
21
|
+
### What to include
|
|
22
|
+
|
|
23
|
+
- Affected version (`npx claudeos-core --version`)
|
|
24
|
+
- Reproduction steps or proof-of-concept
|
|
25
|
+
- Impact assessment (data exposure / code execution / DoS / etc.)
|
|
26
|
+
- Suggested fix (if any)
|
|
27
|
+
|
|
28
|
+
### Response timeline
|
|
29
|
+
|
|
30
|
+
| Stage | Target |
|
|
31
|
+
|--------------------|---------|
|
|
32
|
+
| Initial reply | 48 hours |
|
|
33
|
+
| Triage + severity | 7 days |
|
|
34
|
+
| Fix or mitigation | 30 days for high/critical, 90 days for medium/low |
|
|
35
|
+
|
|
36
|
+
We will keep you informed throughout the process and credit you in the release notes (unless you prefer to remain anonymous).
|
|
37
|
+
|
|
38
|
+
## Scope
|
|
39
|
+
|
|
40
|
+
In scope:
|
|
41
|
+
|
|
42
|
+
- The `claudeos-core` npm package and its CLI (`bin/cli.js`)
|
|
43
|
+
- The 4-Pass pipeline orchestrator (`bin/commands/init.js`)
|
|
44
|
+
- All validators (`claude-md-validator/`, `content-validator/`, `pass-json-validator/`)
|
|
45
|
+
- Generated artifacts (CLAUDE.md, rules, skills, guides) when produced by an unmodified release
|
|
46
|
+
|
|
47
|
+
Out of scope:
|
|
48
|
+
|
|
49
|
+
- Vulnerabilities in third-party dependencies (please report upstream; we will track and update)
|
|
50
|
+
- The `claude` CLI itself (report to Anthropic)
|
|
51
|
+
- User-modified template forks
|