[mrgoonie]

Summary

• fix(interactions): resolve alias slug trong api.user-interactions #47 Slug-taking routes (api.user-interactions, api.skill-review loader+action, api.skill-rate, api.skill-vote, api.usage-report) now resolve through the alias table (resolveSkillBySlug, plus batch resolveSkillIdsBySlugs). Old slugs no longer 404 or return an empty overlay.
• chore: stop tracking .pi/ — it blocks rebase for any session with local goal state #49 .pi/ ignored and untracked. The archived goal docs are dropped from the repo.
• chore(registry): SX-3 review follow-ups (scanner encodings, scan memory, deploy guide env flags) #61 Release scan: BOM-marked UTF-16 decoded; plain-text/LICENSE files skip shell/URL syntax rules; bundled binaries under scripts/ and legacy-codepage .bat/.cmd/.csv no longer quarantined; secret scan runs in 64 KiB windows and instruction docs over 4 MiB are quarantined instead of decoded whole; assertSubrequestBudget runs before scan and signing; --env production dropped from README.
• fix(web): API key settings follow-ups (error handling, CSRF origin check, empty scopes label) #79 DELETE malformed JSON → 400; create dialog stays open with inputs while submitting and shows 400/403; empty scopes → "No access"; scopes: null accepted as omitted (documented); same-origin check on POST/DELETE (lib/auth/same-origin.ts, documented); plaintext key lives only in component state and is dropped on Done; api.skill-favorite client chunk no longer pulls the schema (an unused skills import kept it alive; chunk is now empty and has no key_hash).

Tests

pnpm typecheck clean, pnpm --filter web build ok. New: api.alias-slug-routes.test.ts, extended release-scan.test.ts, release-budget-order.test.ts, user-api-keys-route.test.ts, api-key-settings.test.ts. The full suite passes except packages/cli/src/lib/git-tree-tar.test.ts, which timed out in a hook in one run and passed in another (untouched by this PR).

Review follow-ups

• Oversized (>4 MiB) BOM-marked UTF-16 is now quarantined (danger:text-too-large) instead of slipping past the raw-byte secret scan.
• Syntax relaxation applies only to licence files (upper-case LICENSE/LICENCE/COPYING/NOTICE/AUTHORS, optional upper-case -MIT/-APACHE-2.0 style suffix, .txt/.md/.markdown only; never binaries; a licence file is always also an instruction document); every other licence-like name (NOTICE-install, LICENSE_MIT, PATENTS, license, ...) and every .txt keeps every rule. A latin-1 licence file is instruction-scanned under both its lossy UTF-8 and latin-1 readings; invalid-UTF-8 markup (incl. LICENSE.md) is quarantined as non-utf8-text.
• Lone UTF-16 surrogates rejected via isWellFormed(); MZ binaries under scripts/ need a real PE header; secret windows open one byte early and ignore a match at that extra byte; a match ending exactly at a non-final window edge is left to the next window, but only when it lies wholly in the overlap (long tokens that began earlier still count).
• resolveSkillIdsBySlugs tested against a real migrated SQLite DB.
• Same-origin guard for favorite/vote/rate/review tracked in fix(web): same-origin check on cookie-authenticated mutations (favorite, vote, rate, review) #101.
• .pi/ has left HEAD but stays in git history; history is intentionally not rewritten.

Closes #47
Closes #49
Closes #61
Closes #79

🤖 Generated with Claude Code