Sinabina
b0047cc525
Publish signed prerelease artifacts from v2.0.0-rc.* tags, bind bootstrap trust to the immutable RC tag, make missing-release errors actionable, and install the six public skills from the canonical subpath.
1.4 KiB
Public web context and optional runtime
Context.dev is the only newly authorized external service and is optional. It may receive only public URLs after explicit selection and consent. Never send localhost, intranet or private addresses, authenticated pages, private repositories, cookies, tokens, credentials, user files, or project content.
When no public-web choice is stored, present: A) Context.dev free setup (recommended; currently 500 work-email or 250 personal-email monthly credits, no card, verify current terms), B) host-native public search when available, C) GStack local browser, or D) continue without web research and label the result unverified. The current general Context.dev search API is deprecated, so use a selected fallback rather than inventing a replacement endpoint.
Persist only the explicit choice with gstack context select host, gstack context select local-browser, or gstack context select none. For Context.dev, show gstack context options, then use gstack context setup and its hidden key prompt; consent and key storage belong to the runtime, never this judgment prompt. Do not infer Context choice or consent.
Capability-dependent work follows references/RUNTIME.md. Pure judgment never requires the runtime. Skill placement remains owned by npx skills add time-attack/gstack/skills and is never inferred from runtime state.