chore: sync Harlan upstream and adapt review skills by RedStar071 · Pull Request #22 · wolfstar-project/wolfstar-agent-kit

RedStar071 · 2026-11-05T15:56:49Z

🔗 Linked issue

None.

❓ Type of change

📚 Description

Updates the fork with Harlan changes through 9c94eb40, applying the 42 commits since the previous sync at 8f6ac424. Preserves Wolfstar's current Cloudflare proxy, provider choices, and Oxlint/Oxfmt tooling.

Adds the Octorun host and upstream improvements to worker isolation, recovery, measured vitals evidence, and terminal sessions.
Adapts pr-evidence, review-findings, and review-replies as Wolfstar skills, and folds merge cleanup into take-ownership, with attribution to Aref Mozafari.
Makes manual reproduction instructions optional and keeps social planning in tweet after upstream retired social-presence.

🤖 AI disclosure: Wolfstar Agent Kit modified this description. AI open source policy.

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…arlan-zw#363)

…w#386) * fix(github-agent): verify conflict deletions and index scope * fix(github-agent): preserve Git paths and digest bytes

…harlan-zw#387) * fix(github-agent): normalize poll identity and require check evidence * fix(github-agent): require base evidence for conflict failures

…arlan-zw#388) * fix(github-agent): keep Baseline repair independent of its trigger * fix(github-agent): keep Review snapshots from retiring Baseline work * fix(github-agent): wait for Baseline retirement before Review * fix(github-agent): retire obsolete Baseline ActionRequired * fix(github-agent): resume Review after verified Baseline recovery * fix(github-agent): release completed Baseline repair waits

…zw#391)

…rlan-zw#393) * docs(skills): clarify email and Chrome identities * feat(browser): add prompt-free Clients and Agent Chrome * test(browser): run identity checks in CI * docs(browser): default to Agent with personal login fallback

Routine runs ignored permanent provider configuration failures and spent all three attempts. Use the existing failure class before requeueing, while keeping other retry policies unchanged. Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…#635) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…n-zw#637) Committed screenshots prevented every immutable source and diff read. Preserve text evidence and expose binary metadata without changing review policy. Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…w#640) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…#639) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…w#643) * fix(github-agent): resume stored Review publication retries * fix(github-agent): limit Review recovery to existing retries * fix(github-agent): retain Review publication retry lineage --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

* fix(vitals): bound Scan detail reads and report missing proof * fix(vitals): preserve missing metric coverage * fix(vitals): describe measured persistence after coverage gaps * fix(vitals): split persistence evidence into short sentences --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…#641) * fix(github-agent): authenticate shared SEO routine workers * fix(github-agent): keep guest secrets out of launcher arguments * fix(github-agent): authenticate Routine issue implementations --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…uxt/fonts 1.0 emits fonts as Vite build assets under /_nuxt/fonts, so the dashboard server drops its dead /_fonts route. @pierre/diffs stays on 1.2.0: every later release (harlan-zw#608) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

* fix(vitals): compare Scans within one Lighthouse release * fix(vitals): allow required local performance builds * fix(routines): supply bounded ownership evidence * fix(vitals): block unproved local performance claims --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

* chore(deps): align Octorun Vitest with catalog * fix(sandbox): expose installed browser packages Resolve canonical pnpm package entry points and mount only their declared dependency closure. Start browser commands through the pinned Node runtime without exposing controller browser state. --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Browser setup invokes npm from the worker PATH. Resolve its installed package and bundled dependencies through the existing readonly mounts and pinned Node launcher. Keep the larger dependency bound specific to npm. Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

* fix(sandbox): bootstrap browsers with Node 24 * fix(sandbox): retain package command variants * fix(sandbox): repair missing browser runtime packages * test(sandbox): recover interrupted browser setup * fix(sandbox): narrow npm package lookup explicitly --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

…an-zw#655) * feat(vitals): validate retained performance comparisons * feat(vitals): gate issue publication on measured evidence * fix(vitals): isolate evidence helper from active server --------- Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

Merge harlan-zw/harlan-agent-kit main (9c94eb4, 472 commits) into the Wolfstar fork. Upstream was rebranded and formatted with Oxfmt before the three-way merge, so only real fork changes conflicted. - Keep Oxlint and Oxfmt in place of ESLint, and the Claude provider. - Move Claude support to an idempotent final schema step so upstream migrations keep their numbers. Journals at the fork's old version 58 receive the restart operation columns they skipped. - Keep external Harlan packages and Skill sources under harlan-zw. - CLAUDE.md now imports AGENTS.md, following upstream's rename. - Declare pr-evidence, post-merge-cleanup, review-replies, and review-findings by Aref Mozafari in .skills/skilld.json, pinned by commit.

socket-security · 2026-11-05T15:57:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Quality	Maintenance
vitest@5.0.3 ⏵ 5.0.5	⁺¹	⁺²
h3@2.0.5
@nuxt/fonts@1.0.1
@nuxt/ui@4.11.3 ⏵ 4.12.0		^-3
mermaid@12.1.0 ⏵ 12.2.0
srvx@1.0.6

View full report

coldtea-pr-lens · 2026-11-05T16:05:47Z

Note

The title starts with chore:, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

harlan-zw and others added 30 commits September 30, 2026 18:47

fix(github-agent): clarify worker production authority (harlan-zw#385)

e12a66f

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(deps): pin patched transitive dependencies for security alerts (h…

bbe71c2

…arlan-zw#363)

fix(github-agent): verify conflict paths and captured index (harlan-z…

5b172a1

…w#386) * fix(github-agent): verify conflict deletions and index scope * fix(github-agent): preserve Git paths and digest bytes

fix(github-agent): normalize poll identity and require check evidence (…

6f496be

…harlan-zw#387) * fix(github-agent): normalize poll identity and require check evidence * fix(github-agent): require base evidence for conflict failures

chore: release v5.6.1 (harlan-zw#390)

390ffb7

fix(harlan-github-agent): retire recovered factory incidents (harlan-…

d3cc78d

…zw#391)

docs(agent-context): allow the desktop runner (harlan-zw#392)

64952de

fix(humanize-writing): reject clichés and forced metaphors (harlan-zw…

4ed6dfd

…#395)

refactor(skills): merge social planning into tweet (harlan-zw#396)

a3772ab

refactor(skills): merge close off into take ownership (harlan-zw#398)

6c9822d

feat(github-agent): add GitHub Review controls and sidebar presence (h…

e87c7c1

…arlan-zw#397)

fix(skills): align review rules and provider execution (harlan-zw#399)

096f81c

fix(browser): default unattended automation to headless (harlan-zw#394)

a62389d

feat(github-agent): route public reads through the Agent account (har…

9202bbb

…lan-zw#400)

docs(context): require TypeScript for new scripts (harlan-zw#401)

b1f4eac

feat(skills): add i-dont-know-just-keep-working (harlan-zw#403)

8d45fec

docs(context): rank next steps by impact and effort (harlan-zw#402)

37fbc4e

fix(github-agent): require repository checkbox delivery (harlan-zw#404)

7c2530b

fix(worktrees): seed writable state without Nuxt output (harlan-zw#405)

771a576

fix(github-agent): recover only the newest task attempt (harlan-zw#406)

31bfb40

feat(skills): integrate Brundlefly and remove duplicate writing rules (…

fffddd2

…harlan-zw#407)

feat(github-agent): watch pull requests through service events (harla…

2345cd9

…n-zw#408)

feat(github-agent): retain delivery checks after merge (harlan-zw#411)

0e0e2ec

chore(deps): update dependencies and adopt h3 2.0.1 stable (harlan-zw…

1c7f9f8

…#410)

refactor(skills): import glossary and copywriting from Brundlefly (ha…

448955d

…rlan-zw#412)

feat(github-agent): verify downstream workflow source commits (harlan…

067ce06

…-zw#414)

feat(skills): declare Brundlefly requirements through skilld (harlan-…

3ea43bc

…zw#413)

chore: sync

adbc302

harlan-zw and others added 22 commits October 28, 2026 00:44

fix(github-agent): keep all open Approval requests visible (harlan-zw…

38ba162

…#635) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(github-agent): provide NuxtSEO CLI inside workers (harlan-zw#636)

36c5547

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(github-agent): preserve each workflow in daily evidence (harlan-z…

7694b82

…w#640) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(github-agent): preserve conflict verification blockers (harlan-zw…

d2e5468

…#639) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(github-agent): enable eager declaration emission (harlan-zw#625)

0ac5d55

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

chore(deps): align Octorun Vitest with catalog (harlan-zw#644)

d7c7776

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(sandbox): provide Lighthouse to vitals workers (harlan-zw#651)

491d9c7

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(issues): supply controller ownership evidence (harlan-zw#653)

522fc7f

Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

fix(codex): move sandbox arguments out of the environment (harlan-zw#654

3cbf0f1

) Co-authored-by: Harlan GitHub Agent <harlan-github-agent[bot]@users.noreply.github.com>

chore: reconcile Harlan sync and adapt review skills

492dca2

fix(octorun): use the Wolfstar owner in allow-list tests

2721139

RedStar071 marked this pull request as ready for review November 5, 2026 16:05

RedStar071 merged commit 3bcf558 into main Nov 5, 2026
8 checks passed

RedStar071 deleted the chore/sync-harlan-review branch November 5, 2026 16:12

This was referenced Nov 5, 2026

fix(email): name the Himalaya account wolfstar #23

Merged

feat(lint): run eslint-plugin-harlanzw rules through Oxlint #25

Merged

Navigation Menu

Repository navigation

chore: sync Harlan upstream and adapt review skills - #22

chore: sync Harlan upstream and adapt review skills#22
RedStar071 merged 475 commits into
mainfrom
chore/sync-harlan-review

RedStar071 commented Nov 5, 2026

Uh oh!

socket-security Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

coldtea-pr-lens Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

RedStar071 commented Nov 5, 2026

🔗 Linked issue

❓ Type of change

📚 Description

Uh oh!

socket-security Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coldtea-pr-lens Bot commented Nov 5, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security Bot commented Nov 5, 2026 •

edited

Loading