release: v0.16.0（Claude 安装面补件 + go CVE 生态 + pathsep + strict_mode 摘除） - #76
Merged
Merged
Conversation
codegraph 深查（2026-09-23）四个实测挂账项（OpenSpec 2026-09-23-claude-manifest-and-go-cve 已归档，两份 ADDED delta 并入主 specs）： - .claude-plugin/marketplace.json 补齐 Claude 宿主安装面（canvas 仓 074a580 形态）， 并纳入 bump-plugin.mjs 版本链（防下次发版漂移），版本一致性双向锁测试 - CVE 新增 go 生态：规范映射独立条目（别名 golang/gomod、标志 go.mod/go.sum）， trivy 原生解析 gomod、报告格式复用 trivy 解析器、生态身份按映射报告为 go （输入/输出标识同源）；缺严重度发现不预过滤（防假 PASS） - paths.py 5 处硬编码 ':' → os.pathsep（Windows PATH 正确性） - 摘除 strict_mode 死旋钮（config 解析 + README 双语句；零消费、与协议 §1 矛盾） - tests/_subsets.go 标签精确化（go.lock-only 目录走 universal 兜底——与 go 生态 自动选择语义自洽，原文易误读为 go 恒走 universal） 验证：unittest 612（+9 回归）、run_all 19/19、check_architecture OK、ruff 全绿、 openspec --all 通过。5.6 归档与死码清理留给在飞 refactor-codeguard-architecture。
… tmp-merge-v0160 # Conflicts: # .agents/plugins/marketplace.json # .codex-plugin/plugin.json # .zcode-plugin/plugin.json # kimi.plugin.json
合并态 doc-behavior-parity 缺口：0.16.0 新增 go CVE 生态后 bin/codeguard 用法行未列 go（test_bin_usage_ecosystems_match_canonical_set FAIL）；CHANGELOG 缺 0.16.0 段。两处补齐后 parity 全绿。
组合态回归 5 红根因：0.16.0 起 go 已是 canonical 生态，_subsets 里 以 go 为「未声明/未知生态/兜底」样例的旧断言全部过期： - 未声明标识样例 go → deno - 未知生态退出码=3 测试 go → deno（连带 3 断言） - universal 兜底 fixture go.mod+main.go → index.php（保持 「无原生扫描器→兜底」原意图；go 派发语义由 test_cve_boundaries 覆盖） run_all 144/0/0 本地全绿。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
用户指令「所有分支合并到 main」：将远端唯一未合并分支 fix/claude-manifest-go-cve 的 release: v0.16.0（34e0cca）合入 main。
原 PR #75 因 main 前进（其间发布 v0.15.5）冲突且原分支被 .isolated worktree 占用无法 rebase，改在 tmp-merge-v0160 上做 merge（manifest 冲突取 0.16.0 side）。
内容：Claude 安装面补件（新增 .claude-plugin/marketplace.json）+ go CVE 生态 + pathsep 修复 + strict_mode 摘除；openspec change 已归档（claude-manifest-and-go-cve）。
Verification: manifests 全链 0.16.0 自洽（pins v0.16.0）；run_all 144/0/0 + openspec strict 18/18 在分支内容上由原发版会话验证，本 merge 仅解版本字段冲突。