
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
base-combos
Advanced tools
一句话:本包不画页面,只管“哪条命令走哪条取数通道、长什么样”——combos.yaml 是唯一真相源。
本包不含画图组件;画图去 base-paint(packages/base-render/README.md 的组件目录)。
| 我要 | 调谁/看哪 |
|---|---|
| 发起一条联动取数 | comboEnvelope(key)(先过注册表校验,对不上即抛错) |
| 查有哪些命令可用 | PRESENT_KEYS(生成物,147 条,以 combos.yaml 重核为准) |
| 加一条联动 | combos.yaml 加一行+过 tooling/check-combos.mjs,不改代码 |
| 看唤醒词与呈现 | HELP.md 互联区(构建期注入的静态投影) |
| 看场景语义与降级 | combos.yaml 的 scenarios/fallbacks 段 |
comboEnvelope(key):按注册表校验命令后造 list 信封(骨架占位;真实载荷各技能实施)。源:src/index.ts。PRESENT_KEYS:命令表(src/present.ts,由 scripts/gen-present.mjs 从 combos.yaml 生成,手改无效)。base-link-core(createRegistry):命令先过注册表,载荷走信封全字段。combos.yaml 头注释铁律)scenarios 30 条联动场景+l6_slots 6 个空位(一期不实现,内容不记录)。channels 15 对(命令 × 形状 × 背书);降级 fallbacks 6 条(显式标记,不编造)。HELP.md 是真相源的静态投影:构建期注入,运行时不计算。present 层只许 string 字面量引注册表命令,禁 import 页面交付层(src/present.ts 首行注释)。
node --test ../../test/scaffold.test.mjs(包内无单测目录)。tooling/check-combos.mjs。FAQs
语义包:combos.yaml 唯一真相源,36 组语义条目
We found that base-combos demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.