SkillSpector 2.14.0 release

.env.example

@@ -36,13 +36,19 @@ OPENAI_BASE_URL=
 # Optional provider- and model-dependent reasoning-effort setting. Non-empty values
 # are trimmed and passed through unchanged. Unset or blank sends high for nv_build
 # with z-ai/glm-5.3; other provider/model combinations keep their endpoint defaults.
+# gpt-6.1-sol accepts only low, medium, high, xhigh or max; any other value stops
+# a scan before analysis (exit code 2).
 SKILLSPECTOR_REASONING_EFFORT=
 # Optional language for human-readable LLM finding text. Machine-readable values
 # such as rule IDs and severity values remain unchanged.
 SKILLSPECTOR_OUTPUT_LANGUAGE=
 # Optional sampling controls. Temperature is supported by hosted providers;
 # seed is forwarded only to OpenAI-compatible and Azure OpenAI endpoints.
-# Unset or blank values preserve provider defaults.
+# Unset or blank values preserve provider defaults. gpt-6.1-sol rejects every
+# explicit temperature. Claude Opus 4.7+, Sonnet 5, Fable 5 and Haiku 5 models accept only 1.0
+# on the native Anthropic endpoint; other routes reject every explicit value.
+# Unsupported settings on active LLM slots stop the scan before analysis.
+# Static scans (--no-llm) skip provider initialization and these checks.
 SKILLSPECTOR_TEMPERATURE=                                    # range: 0..1
 SKILLSPECTOR_SEED=                                           # integer
 
@@ -73,11 +79,16 @@ AZURE_OPENAI_ENDPOINT=
 # For SKILLSPECTOR_PROVIDER=openai_compatible.
 SKILLSPECTOR_COMPAT_API_KEY=
 SKILLSPECTOR_COMPAT_BASE_URL=
+# Optional JSON object with string header names and values; may contain secrets.
+# SKILLSPECTOR_COMPAT_HEADERS='{"X-Tenant-ID":"my-tenant","X-API-Key":"gateway-key"}'
 
 # claude_cli, gemini_cli, and opencode_cli use their CLI's existing local
 # authentication session and do not need an API key here.
 
 # SkillSpector config
+# Defaults: openai uses gpt-5.4; anthropic uses claude-opus-4-6 and
+# claude-sonnet-4-6 for meta_analyzer. Sol and Claude 5.5 remain opt-in pending
+# live scanner acceptance (see README).
 SKILLSPECTOR_MODEL=                                             # leave empty to use the active provider's bundled default (see README); set to override (e.g. gpt-5.2)
 # SKILLSPECTOR_MODEL_REGISTRY=./model_registry.yaml             # optional override; defaults to each provider's bundled YAML in src/skillspector/providers/
 SKILLSPECTOR_LOG_LEVEL=WARNING                                  # options: DEBUG|INFO|WARNING|ERROR

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ name: CI
 
 on:
   pull_request:
-    branches: ["main", "yashraj/v2.13.0-base"]
+    branches: ["main", "yashraj/v2.13.0-base", "yashraj/release-2.13.3"]
   push:
     branches: ["main", "yashraj/v2.13.0-base"]
 
@@ -89,6 +89,8 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
       - run: make install-dev
       - run: uv run skillspector --version
+      - name: Check isolated dependency inspection before the full suite
+        run: uv run pytest -q tests/unit/test_dependency_inspection.py
       - run: uv run make test-ci
 
   test-opencode:

CHANGELOG.md

@@ -1,3 +1,13 @@
+### 2.14.0 (Unreleased)
+### Changes after the integrated 2.13.3 baseline
+* Include 42 merged priority sources (19 P0, 23 P1), 5 required prerequisites and seven model sources: 54 distinct sources with new deltas. Retain all 31 original selections; count inherited overlaps separately.
+* Add bounded npm content inspection, truthful malformed-manifest/BOM/fallback coverage, advisory dependency pins, parser/quote/PowerShell/Markdown ownership, interruptible matching and multiline-shadow handling.
+* Add occurrence surface metadata, cookie-store and local-return precision, safe report-output preflight, supported model-control guards, option-help precision and deferred startup warnings. The earlier RA1 double-negative gap is corrected by #957.
+* Keep GPT-5.4/Claude 4.6 defaults and opt-in newer models. Absorb final #958/#976 maintenance work; #877 is fully inherited, #948 contributes only its new residual, and #981 is a formatter prerequisite.
+* Retain sanitized failed-request diagnostics for synchronous and asynchronous model calls without copying request/source content or changing exception/usage behavior. (#979)
+* Final validation and release review remain required; historical results do not establish current-candidate acceptance.
+* See [release notes](docs/release/skillspector-2.14.0.md) and [selection manifest](docs/release/skillspector-2.14.0-manifest.json) for source and overlap evidence.
+---
 ### Unreleased maintenance fixes
 ### Fixes
 * Backport scoped `allowed-tools` grant handling from #768: recognize declarations such as `Bash(git:*)`, preserve spaces and commas inside scopes, and keep malformed grants or embedded tool names from declaring shell capability. Command restrictions remain intact in the manifest.