Audit findings - #12
Merged
Merged
Conversation
…it P0-4) The arg parser ran non-strict, so a mistyped or hallucinated flag was swallowed: the command succeeded, exited 0, charged the account, and returned data that did not reflect the request (e.g. the homepage's `--format markdown` returned HTML). For an agent this is the worst failure mode — it reasons on top of a wrong result. Parse with tokens, detect any option not declared by the command (global flags stripped by the router are exempt), and throw UNKNOWN_FLAG with the offending flag + a Levenshtein "did you mean". Adds UNKNOWN_FLAG (and SIGNUP_FAILED, used next) to the error union. Tests cover accept/reject/suggest/globals. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…-3, P1-6) Two honesty defects in the first output an agent reads: - init announced "No API key configured. Run `zenrows login`" — the opposite of the zero-config promise. It now reflects reality: with auto_signup on (default) a key is provisioned automatically on the first cloud call; only with signup off does it point at login. - init logged "Wrote config.json + policy.json" but never wrote config.json (the guard used loadConfig, which always returns merged defaults, so it never fired — also silently dropping `init --no-telemetry`). Write it when the file is absent; the claim is now true and --no-telemetry persists. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ble assets (P2-10, P1-7a) - status and asset `list` --json now lead with `ok: true`, so an agent can branch on `.ok` across every command (the rest were done in the consistency pass). - `<asset> install --all` filtered by status available/experimental, which excluded beta — so `skill install --all` skipped the (runnable) batch-jobs playbook. Filter by assetRunnable instead, matching `plugin install`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…FAILED (audit P1-5) A signup failure surfaced under FETCH_FAILED with 200 chars of raw Cloudflare HTML as the cause — an agent branching on error.code could not tell "no credentials" from "the target page failed". Use SIGNUP_FAILED, detect the bot- challenge signature for a real cause, and give an actionable next step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…1-7b) - README quickstart used `npx -y … init` then a bare `zenrows` call, which is not on PATH after npx (command not found on line 2). Recommend the global install (466 ms, zero deps); keep an npx note for those who prefer it. - The master skill routed "many URLs -> fan out fetch/extract per URL", steering bulk work off batch — ~25x more credits at scale, on the exact workload Zenrows says it wins. Route bulk to `zenrows batch` (validate one page first) and fix the status table's understatement of batch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
--help listed every flag but never the price, so an agent could not weigh cost before spending. Add the credit multipliers (1x normal / 5x --js-render / 10x --premium-proxy / 25x both) and note the exact charge is always reported after the request (costCredits / X-Request-Credits). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…it P2-11) For RESP007 (domain does not resolve) and RESP002 (404) the generic handler told the agent to "retry with --js-render --premium-proxy" — a retry that fails identically and still costs credits, since no configuration can reach a host that doesn't exist. Map these to a no-retry message (explaining the flags won't help) with no escalation command. A human can still try a corrected URL. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signup resolved a single endpoint (discovery, else the built-in default) and tried it once — so a discovery document pointing at a wrong or bot-challenged host broke provisioning 100% of the time, with no recovery. That was the original outage.
- Drop the duplicate "explain" in `workflow`/`recipe --help` usage strings
(extraUsage() appended "|run|explain" even though "explain" is already
part of the shared base usage string).
- Fix "a eval" -> "an eval" in both the `install` and `explain` help lines
for the eval asset type.
- Add the working but undocumented `reset` subcommand to `config --help`'s
usage string, matching how `policy --help` already documents its own reset.
- Remove the leftover internal dev note from `mcp config --client claude-code`
("Confirmed: `claude mcp add ...`") — it repeated the command already
printed below it and read as an internal QA annotation, not user-facing
guidance, unlike the genuinely useful notes on vscode/codex.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Help-text and MCP-note cleanup (bug bash follow-up)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.