Draft: prepare secure CLI 0.3.0-rc.2 with exact MCP candidate

[elemdos]

Prepares primo-cli 0.3.0-rc.2 from #64–#66, pinned exactly to primo-mcp 0.1.11-rc.2 (compiler fix primocms/mcp#29). The retained MCP vendor archive keeps source npm ci reproducible without registry publication; the normal CLI tarball contains dist/scripts.

Security follow-up in #65 removes extract-zip, rejects ZIP links/special files/traversal/duplicate aliases/Windows device names before writing, refuses existing files/links, and preserves normal umask-based asset readability. A disposable symlink-then-file archive overwrites an outside sentinel with the old dependency; the new regression refuses it without writing. Twenty-six archive cases also run against the installed package across all five CMS native CI targets. Chokidar 4 removes the unpatched braces path; esbuild and security-affected transitive locks are updated. Full npm audit is clean. #64 also includes the actual installed-tarball Svelte-resolution regression.

Fresh rc.2 kit installations pin both local tarballs and transitives, with no dependency overlays. Full installed-CLI tests, six compiler regressions per Node baseline and the entire agent/client handoff are rerun against the exact packages, including live watcher import and retained IDs. The final results and hashes are in the local rc.2 kit.

Refs primocms/primo#1239, primocms/primo#1241 and primocms/primo#1309. Before public release, publish the approved MCP first, refresh the temporary local lock to the exact registry version/integrity, remove the vendor archive, repack, and repeat exact-package verification. Make the approved CMS available before the public CLI.

Draft only: do not merge, tag, publish or deploy. Version selection and public release remain separate maintainer decisions.

Final verification complete: all 187 installed-CLI tests pass with zero skips on each of Node 22.13.0 and 24.0.0; both complete exact-final-package handoffs pass, as do six compiler and three final-CMS contract tests per runtime. All five final native platforms pass (26 ZIP cases plus the native content/permissions/restart/static-build flow). CMS full browser CI passes 40 tests with one existing skip. Final native executables are downloaded and checksum-verified before handoff; Go build metadata confirms 1.26.9/PocketBase 0.39.7 on every target. Upgrade/backup restoration passes on final bytes. Full candidate npm audits are clean and Go has zero reachable findings. All eleven PRs remain draft with green final-head CI; no merge, tag, package/release publication or deployment.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}