chore(sync): pstack-claude 0.9.74

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "t3-pstack",
       "source": "./plugins/pstack",
       "description": "pstack for T3 Code: rigorous agent workflows whose panels and fan-outs run across model families through T3. Original pstack by Lauren Tan (poteto); Claude Code port by Michael Denyer.",
-      "version": "1.0.2"
+      "version": "1.0.3"
     }
   ]
 }

.github/workflows/ci.yml

@@ -47,6 +47,21 @@ jobs:
         env:
           PSTACK_REQUIRE_WINDOWS_HOOK: "1"
 
+  windows-worktree-audit:
+    name: Windows worktree audit
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.14"
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Test the worktree audit
+        run: bun test --timeout 30000 tests/worktree-audit.test.mjs
+
   forks:
     name: Fork registry
     runs-on: ubuntu-latest
@@ -61,14 +76,21 @@ jobs:
         run: bun install --frozen-lockfile
       # A dry-run sync to the SHA already pinned compares the port with
       # upstream as it stands, and fails on a fork tools/forks.json lacks or
-      # an entry whose path is not forked.
+      # an entry whose path is not forked. bash ignores the exit status of a
+      # process substitution, so jq fills a variable first. Fed straight to
+      # the loop, a jq error runs it zero times and the step passes.
       - name: Check every fork from upstream is declared
         run: |
-          set -o pipefail
+          set -eo pipefail
+          components=$(jq -r '.components | to_entries[] | "\(.key) \(.value.sha)"' tools/upstream.json)
+          if [ -z "$components" ]; then
+            echo "tools/upstream.json lists no components"
+            exit 1
+          fi
           failed=0
           while read -r component sha; do
             bun tools/sync.mjs "$component" "$sha" --dry-run | tee "$RUNNER_TEMP/sync-$component.txt" || failed=1
-          done < <(jq -r '.components | to_entries[] | "\(.key) \(.value.sha)"' tools/upstream.json)
+          done <<< "$components"
           exit "$failed"
       # Annotates rather than fails: generated edits and declared forks are
       # legitimate, but a reviewer should see every upstream skill file a PR
@@ -131,11 +153,14 @@ jobs:
         run: npm install -g --ignore-scripts @earendil-works/pi-coding-agent@1.0.0 # zizmor: ignore[adhoc-packages]
       - name: Typecheck the extension against Pi
         run: bun tools/typecheck-pi.mjs
-      # Skipped in every job without Pi; here a catalog that is not found fails.
-      - name: Check the shipped model tables against Pi's catalog
-        run: bun test tests/pi/catalog.test.mjs
+      - name: Install test dependencies
+        run: bun install --frozen-lockfile
+      # These checks make no model calls. Missing Pi fails instead of skipping.
+      - name: Check the model catalog and child startup against Pi
+        run: bun test tests/pi/catalog.test.mjs tests/pi/runtime.test.mjs
         env:
           PSTACK_PI_REQUIRE_CATALOG: "1"
+          PSTACK_PI_REQUIRE_RUNTIME: "1"
 
   scripts:
     name: Vendored bun tooling
@@ -225,3 +250,20 @@ jobs:
             lycheeverse/lychee:0.24.2@sha256:e2d19e57cf6ab037026f20b8e449a1f30d9d7f81eef4194763aab2eab20bd28d \
             --offline --no-progress --include-fragments \
             --exclude-path node_modules --exclude-path .git '**/*.md'
+
+  # macOS differs from ubuntu where the audit looks: BSD du pads its sizes and
+  # the temp directory sits behind the /var link.
+  macos-worktree-audit:
+    name: macOS worktree audit
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.14"
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+      - name: Test the worktree audit
+        run: bun test --timeout 30000 tests/worktree-audit.test.mjs

.github/workflows/security.yml

@@ -28,26 +28,17 @@ jobs:
       # Pinned to the image rather than google/osv-scanner-action, whose own
       # README warns its behavior can change in a patch release.
       #
-      # --include-git-root is required: the scanner skips the git root by
-      # default, and the only lockfile lives inside this repo. Without it the
-      # scan finds nothing and passes, which reads exactly like a clean result.
-      #
-      # shell: bash adds pipefail. The default `bash -e` returns tee's status,
-      # so a scanner exit 1 on a vulnerability would pass the step.
+      # Do not add --include-git-root. With it the checkout's .git counts as a
+      # package, so a scan that finds no lockfile exits 0. Without it that scan
+      # exits 128 and fails the step, and both bun.lock files are still scanned.
       #
       # The v2.5.1 tag is mutable, so the digest is what actually pins this.
       # Resolved with: docker buildx imagetools inspect ghcr.io/google/osv-scanner:v2.5.1
       - name: Scan lockfiles
-        shell: bash
         run: |
           docker run --rm -v "$GITHUB_WORKSPACE:/src" \
             ghcr.io/google/osv-scanner:v2.5.1@sha256:8108ae94eadea5a02c9bec6e646909d5b790b44bd62d7f5b7f0b1d6d0ffc7734 \
-            scan source --recursive --include-git-root /src \
-            | tee osv-output.txt
-          if grep -q 'No package sources found' osv-output.txt; then
-            echo "FAIL: osv-scanner found no lockfiles to scan; a silent pass is not a clean scan"
-            exit 1
-          fi
+            scan source --recursive /src
 
   zizmor:
     name: Workflow static analysis