docs: sync SKILL.md permissions with actual file access + fix session notes#30
Merged
Conversation
… notes The permissions block under-declared two real capabilities: the loader reads a working-directory .env (allowlisted SPEEDIANCE_* keys only) and config set writes config.json. Both are now advertised, keeping advertised == actual (CLAWHUB_STANDARDS section 4, CLI_CONVENTIONS section 0). Also corrects three consumer notes: the "Empty shape" bullet no longer claims kind:"free" detail is always [] (guided free sessions populate it, per the doc's own table), the auto-detection note now matches today's type-driven free-first probe order, and the library section states that --search still saves the full catalog. TestSkillDocAdvertisesFileAccess pins the permissions block: a real file read/write missing from files.read/files.write now fails the build, the same negative-assertion pattern as the env-var guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A8iTURjzM2PCGj1AAZx2GZ
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes four advertised-vs-actual gaps found reviewing SKILL.md against the code, and pins the permissions block with a new immutable guard test.
SKILL.md corrections
files.readnow declares the working-directory.env— the loader reads it viagodotenv.Read()(internal/config/config.go), but the permissions block never advertised the read. The entry notes the safeguard: onlySPEEDIANCE_*keys are consulted, parsed to a map, never exported into the process environment.files.writenow declaresconfig.json—config setwrites it (internal/cli/config.gosetConfigKey, 0600), but the write block only listed the token cache andlibrary.json.detailis[]forkind:"free", contradicting the doc's own table: a guided free-namespace session (e.g. Aerobic Rowing) has a populateddetail. An agent reading only that bullet would skip real rowing data.session <id>defaults program-first, buttodaypicks each session's probe order from the record list's authoritative type (free-first for non-program types,api.modeForType). Output shape is identical; the sentence now says so accurately.--searchstill saves the full catalog to--out— the write was always announced on stderr but not obvious from the examples.Guard test
TestSkillDocAdvertisesFileAccess(internal/config/skill_doc_test.go) extends the §0 advertised == actual guard from env vars to thefiles.read/files.writepermissions lists: any real file access missing from the block fails the build. Same negative-assertion pattern asTestSkillDocAdvertisesEveryEnvVar; verified red when an entry is removed, green as committed.Verification
go build ./... && go vet ./... && go test -race ./...all pass;gofmt -lclean.config.jsonfiles.write entry turns the test red.🤖 Generated with Claude Code
https://claude.ai/code/session_01A8iTURjzM2PCGj1AAZx2GZ