Starstruk Logo MarkStarstruk

skill-v4.0.2

pbakaus/impeccableskill-v4.0.2Jul 23, 2026by pbakaus

AI Summary

This update focuses on security, specifically addressing CORS and directory traversal vulnerabilities. It also fixes Live mode regressions in React and Vite environments and adds first-class support for TanStack Router and Start.

Key Highlights

  • Security fixes (CORS and directory traversal)
  • Live mode unregression for React/Vite
  • TanStack Router and Start support
  • Stop hook behavior fix
  • Quality-bar card fixes

New Features

  • Atomic source writes per cycle
  • Progressive injection fixes
  • Variant cycle skipping

Full Release Notes

- **Security.** The live helper no longer serves its bearer token to any page that asks: loopback-only CORS and a token-gated script (#304). The `/source` route can no longer read sibling directories whose names extend the project root (#401).

- **Live mode, unregressed.** One atomic source write per cycle again, so React and Vite apps stop reload-storming mid-generation; progressive injection no longer races React ownership; the progress bar never moves backward; a dropped tab resumes instead of ending the session; and variant cycles skip redundant per-variant QA.

- **TanStack, first class.** TanStack Router works on the standard Vite path, and TanStack Start gets a real SSR adapter, both covered by e2e fixtures.

- **Hooks behave.** The Stop hook honors `stop_hook_active`, so a declined finding can never re-block your turn twenty times (#400). The doctor no longer reports a correctly installed hook as missing (#402).

- **Sharper flows.** The finish review runs as a shipped subagent with clear authorization on gated harnesses; quality-bar cards download into the workspace so sandboxed viewers can open them; and under hard turn caps the shipped page outranks optional imagery.