chore: untrack CLAUDE.md and .claude/; unbreak the build (TS 7, audit gate) - #56
Merged
Conversation
`main` should not carry agent context. Both paths are now gitignored and removed from the index with `git rm --cached`, so every working copy keeps its files on disk — nothing to re-create, and local agent workflows are unchanged. The .gitignore entries replace the narrower rules that the broad `.claude/` rule now subsumes, so there is one place this is expressed rather than three. Two consequences worth knowing, neither of which blocks this: 1. A **fresh clone has no agent context** — that is the point, but it also means anything that reads these paths from a CI checkout or a cloud/web session sees nothing. Those environments never have a local copy to fall back on, unlike a developer's machine. 2. Where a `.claude/hooks/session-start.sh` exists, it stops running in fresh-clone sessions for the same reason. If that setup is load-bearing for remote sessions it needs a tracked home outside `.claude/`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs | aadce32 | Commit Preview URL Branch Preview URL |
Aug 10 2026, 10:51 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nyuchi-docs-mcp | aadce32 | Commit Preview URL Branch Preview URL |
Aug 10 2026, 10:51 AM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
shamwari-docs-ai | aadce32 | Commit Preview URL Branch Preview URL |
Aug 10 2026, 10:51 AM |
… gate `main` has been red since 5 Aug (three consecutive runs, latest 9e16c3b), so the docs site has not deployed in five days. Two independent failures, neither caused by any code change: **1. The audit gate (this is where CI actually stopped.)** `pnpm audit --audit-level=high` runs before the build, so the build failure below was never even reached. Two high advisories had appeared against an unchanged lockfile: undici via wrangler>miniflare (patched >=7.29.0, so the existing `<7.28.0` override no longer covered it) and js-yaml via @astrojs/starlight (patched >=4.3.1). **2. The build.** `typescript` was `^7.0.2`, and svelte2tsx cannot work with TypeScript 7 — `svelte-package` dies with `Cannot read properties of undefined (reading 'fileExists')`, taking `site` down with it because the search package is a build dependency. This is not a version-lag problem to wait out: the *latest* svelte2tsx (0.7.59) still peers `typescript@^4.9.4 || ^5.0.0 || ^6.0.0`, so no released version supports TS 7. Pinned back to ^6.0.0, with a matching pnpm override so nothing transitively drags 7.x back in. pnpm only warns on an unmet peer, which is why this shipped. **A documented assumption that has expired.** The js-yaml high could not be fixed by the previous note's reasoning — that ≥4.2.0 "drops the ESM default export Astro imports", which is why the advisory was being left alone deliberately. That is no longer true; Astro/Starlight has moved on. Verified rather than assumed: with js-yaml forced to ^4.3.1 the site builds all 58 pages and every package's tests pass. Recording it here because it contradicts a standing instruction, and the file that carried that instruction is no longer tracked. Verified: pnpm audit --audit-level=high clean (was 4 moderate + 2 high), pnpm -r build succeeds (58 pages), pnpm -r test passes (4 packages), validate-skills passes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
bryanfawcett
changed the title
bryanfawcett
marked this pull request as ready for review
August 10, 2026 10:16
`site/scripts/sync-auth-md.mjs` pulls this file through from `https://api.nyuchi.com/AUTH.md` on every docs build; the committed copy is only the offline fallback used when that fetch fails. Running the build locally regenerated it, and the diff is real upstream drift rather than noise — so committing it is the point of the fallback existing. The stale copy documented "Two credential types". The gateway now documents three, separating an API key (`nyk_`/`nys_`, carries a secret, scoped to product namespaces) from a sign-in app (`nya_`, public client identifier with no secret, exists only so `/v1/auth/workos/login` knows which app's redirect_uris to validate `return_to` against). Conflating those two is the specific mistake the gateway's docs now warn about, so a fallback that predates the distinction is worse than useless if it ever gets served. Content verified as a complete fetch, not a truncated response or an error page: 270 lines, valid markdown, no HTML or gateway-error markers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
bryanfawcett
pushed a commit
that referenced
this pull request
Aug 10, 2026
#56 held the tree on the classic 6.x line with a `typescript: ^6.0.0` entry in the root `pnpm.overrides`, which is the right mechanism and is what makes the build green. This closes the loop that produced the breakage in the first place. The history is the argument. 0e520fc pinned typescript to 6.x deliberately, diagnosing that TypeScript 7 — the Corsa/native rewrite — no longer re-exports the classic compiler API, so `ts.sys` is undefined and svelte2tsx crashes emitting .d.ts for nyuchi-docs-search. Six days later the majors group reverted that pin in #54 and broke the build. Nobody noticed, because `build.yml` runs `pnpm audit` ahead of `pnpm -r build` and the audit gate was already red, so the build step never executed. With the override in place a repeat bump is inert, which is precisely why it is worth suppressing rather than tolerating: the next such PR would look harmless and merge clean, leaving package.json declaring ^7 while overrides force ^6 — an inconsistency that invites someone to "tidy up" the override and break the build for real. Carries its own exit condition: drop this entry together with the override when svelte2tsx supports the TS 7 API. Not before, and not one without the other. Verified: dependabot.yml parses, both groups intact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KQPxAPY7KvsN9WLbdLSQED
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits. The second is a base-branch repair —
mainhas not built since 5 August.1. Untrack
CLAUDE.mdand.claude/mainshould not carry agent context. Removed withgit rm --cached, so every existing working copy keeps its files on disk — the five internal skills still work locally.7 paths untracked:
CLAUDE.mdplus.claude/skills/{README,agent-readiness,docs-drift-audit,kweli-docs-sync,mzizi-shell,release-mcp}. The published bundle innyuchi-docs-skills/is untouched — that's the public half of this repo's deliberate split.The skills validator still passes — verified, not assumed
scripts/validate-skills.mjsis abuild.ymlstep and enforces the public/internal split. Its internal loop is wrapped inif (existsSync(INTERNAL_DIR)), so an absent directory is skipped. Ran it both ways rather than trusting the read:One guard this weakens
The final check — that no skill name exists in both homes, because "a duplicated skill drifts" — is now unenforceable in CI, which will always see 0 internal skills. It still works for anyone running
pnpm skills:validatelocally. So the split becomes local discipline rather than a CI gate. Making it a gate again means moving the internal skills to a tracked path outside.claude/and repointingINTERNAL_DIR— a separate decision from this one, happy to do it as a follow-up.2. Unbreak the build
mainhas been red since 5 Aug (three consecutive runs, latest9e16c3b8— this branch's base), so the docs site has not deployed in five days. Two independent failures:The audit gate — where CI actually stopped
pnpm audit --audit-level=highruns before the build, so the build failure below was never even reached. Two high advisories had appeared against an unchanged lockfile:undiciwrangler > miniflare>=7.29.0— the existing<7.28.0override no longer covered itjs-yaml@astrojs/starlight>=4.3.1The build — TypeScript 7 is unusable here
typescriptwas^7.0.2, and svelte2tsx cannot work with it:svelte-packagedies withCannot read properties of undefined (reading 'fileExists'), takingsitedown too because the search package is a build dependency.This is not a version-lag problem to wait out. The latest svelte2tsx (0.7.59) still peers
typescript@^4.9.4 || ^5.0.0 || ^6.0.0— no released version supports TS 7. Pinned back to^6.0.0with a matching pnpm override so nothing transitively drags 7.x back. pnpm only warns on an unmet peer, which is how this shipped.A documented assumption that has expired
The js-yaml high couldn't be fixed under the previous reasoning — that ≥4.2.0 "drops the ESM default export Astro imports", which is why the advisory was being left alone on purpose. That is no longer true; Astro/Starlight has moved on. Verified rather than assumed: with js-yaml forced to
^4.3.1the site builds all 58 pages and every package's tests pass.Flagging it prominently because it contradicts a standing instruction — and the file that carried that instruction is, as of commit 1, no longer tracked.
Test Plan
pnpm audit --audit-level=high— clean (was 4 moderate + 2 high)pnpm -r build— succeeds, 58 pagespnpm -r test— passes across all 4 packagesnode scripts/validate-skills.mjs— passes with.claude/present and absentnyuchi-docs,nyuchi-docs-mcp,shamwari-docs-ai) deployed green on the fix commit — thenyuchi-docssite build had failed on the previous commitgit check-ignoreconfirms both patternsRelated
Untracking applied across
nyuchi/nhimbe#128,nyuchi/kweli#123,nyuchi/kweli-mcp#8,nyuchi/api-gateway#47,nyuchi/mukoko-platform#221.🤖 Generated with Claude Code
https://claude.ai/code/session_01HFaeL83iEL5gqQXhHweH6u
Generated by Claude Code