Repository navigation
Prepare Synter 1.2.1 packages for OpenAI and Claude - #23
Merged
Merged
Conversation
|
Important Review skippedToo many files! This PR contains 105 files, which is 5 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configuration
⛔ Files ignored due to path filters: 1
📒 Files selected for processing: 105
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jshorwitz
marked this pull request as ready for review
October 22, 2026 01:35
![synter-engineer-agent[bot]](https://avatars.githubusercontent.com/u/2186017?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Reviewed the complete frozen 106-file diff and performed the separate explicit workflow bootstrap security review. The prior RSA and bidding finding is resolved across all shipped distributions: shared root sources now remove arbitrary headline quotas and Ad Strength launch gates and retain required conversion bidding; redundant directory overrides are removed. The70-file directory distribution remains byte-identical to its reviewed corrected payload, with no local hooks, executable scripts, SDK or dependency installation, and HTTPS-only remote MCP. Other archives intentionally change to carry the shared correction. Exact-head evidence confirms20Node and10Python tests, strict root/directory validation, clean source identity, archive inventories and hashes. Reviewer independently reran10package tests, directory drift and git diff checks; all passed. Workflow bootstrap inspection found no new privileged PR execution, secret exposure or broader permissions: tag-only release retains a version check, while PR tests are credential-free. Automated protected-path COMMENT behavior is preserved. Source approval does not establish marketplace acceptance, a fresh OAuth/install flow or production deployment.
Reviewed head: ac6b17b0ff15152560ab58b6db804f72de275b9e
Base: 2f760f2d16463e085f3f5839391f2656419aea0c
Coverage: 106 changed files. Reviewer: independent Codex agent.
This diff changes protected workflow files. This comment records the independent source verdict; the protected-path approval gate remains in force.
Validated verdict:
{
"head_sha": "ac6b17b0ff15152560ab58b6db804f72de275b9e",
"base_sha": "2f760f2d16463e085f3f5839391f2656419aea0c",
"verdict": "approve",
"reviewed_files": [
".claude-plugin/marketplace.json",
".claude-plugin/plugin.json",
".cursor-mcp.json",
".cursor-plugin/marketplace.json",
".cursor-plugin/plugin.json",
".github/workflows/release.yml",
".github/workflows/validate.yml",
".mcp.json",
"CHANGELOG.md",
"README.md",
"SECURITY.md",
"agents/creative-director.md",
"agents/media-buyer.md",
"config/claude-directory/README.md",
"config/claude-directory/help.md",
"config/openai-submission.json",
"mcp.json",
"packages/claude-directory/.claude-plugin/plugin.json",
"packages/claude-directory/.mcp.json",
"packages/claude-directory/LICENSE",
"packages/claude-directory/README.md",
"packages/claude-directory/agents/audience-builder.md",
"packages/claude-directory/agents/budget-optimizer.md",
"packages/claude-directory/agents/campaign-strategist.md",
"packages/claude-directory/agents/creative-director.md",
"packages/claude-directory/agents/media-buyer.md",
"packages/claude-directory/agents/performance-analyst.md",
"packages/claude-directory/assets/logo.png",
"packages/claude-directory/context/brand-and-safety.md",
"packages/claude-directory/output-styles/synter.md",
"packages/claude-directory/skills/ad-copy-generation/SKILL.md",
"packages/claude-directory/skills/ad-policy-compliance/SKILL.md",
"packages/claude-directory/skills/anomaly-detector/SKILL.md",
"packages/claude-directory/skills/attribution/SKILL.md",
"packages/claude-directory/skills/audience-expansion-strategy/SKILL.md",
"packages/claude-directory/skills/audience/SKILL.md",
"packages/claude-directory/skills/bid-optimization/SKILL.md",
"packages/claude-directory/skills/campaign-preflight/SKILL.md",
"packages/claude-directory/skills/campaign-structure-auditor/SKILL.md",
"packages/claude-directory/skills/competitor-analysis/SKILL.md",
"packages/claude-directory/skills/connect/SKILL.md",
"packages/claude-directory/skills/conversion-tracking/SKILL.md",
"packages/claude-directory/skills/creative-fatigue-detector/SKILL.md",
"packages/claude-directory/skills/creative-testing/SKILL.md",
"packages/claude-directory/skills/creative/SKILL.md",
"packages/claude-directory/skills/dayparting/SKILL.md",
"packages/claude-directory/skills/executive-reporting/SKILL.md",
"packages/claude-directory/skills/first-party-data-strategy/SKILL.md",
"packages/claude-directory/skills/geo-integrity-audit/SKILL.md",
"packages/claude-directory/skills/google-ads-quality-score/SKILL.md",
"packages/claude-directory/skills/google-shopping-optimizer/SKILL.md",
"packages/claude-directory/skills/help/SKILL.md",
"packages/claude-directory/skills/incrementality-testing/SKILL.md",
"packages/claude-directory/skills/keyword-research/SKILL.md",
"packages/claude-directory/skills/kill-scale-rules/SKILL.md",
"packages/claude-directory/skills/landing-page-creation/SKILL.md",
"packages/claude-directory/skills/launch/SKILL.md",
"packages/claude-directory/skills/linkedin-ads-targeting/SKILL.md",
"packages/claude-directory/skills/llm-visibility-audit/SKILL.md",
"packages/claude-directory/skills/media-plan/SKILL.md",
"packages/claude-directory/skills/meta-ads-diagnostics/SKILL.md",
"packages/claude-directory/skills/mmm-budget-planner/SKILL.md",
"packages/claude-directory/skills/negative-keywords/SKILL.md",
"packages/claude-directory/skills/optimize/SKILL.md",
"packages/claude-directory/skills/performance-max-optimizer/SKILL.md",
"packages/claude-directory/skills/pixel-capi-auditor/SKILL.md",
"packages/claude-directory/skills/platform-amazon/SKILL.md",
"packages/claude-directory/skills/platform-benchmarks/SKILL.md",
"packages/claude-directory/skills/platform-google/SKILL.md",
"packages/claude-directory/skills/platform-linkedin/SKILL.md",
"packages/claude-directory/skills/platform-meta/SKILL.md",
"packages/claude-directory/skills/platform-microsoft/SKILL.md",
"packages/claude-directory/skills/platform-openai/SKILL.md",
"packages/claude-directory/skills/platform-reddit/SKILL.md",
"packages/claude-directory/skills/platform-tiktok/SKILL.md",
"packages/claude-directory/skills/platform-x/SKILL.md",
"packages/claude-directory/skills/pre-pause-analysis/SKILL.md",
"packages/claude-directory/skills/quickstart/SKILL.md",
"packages/claude-directory/skills/replicate/SKILL.md",
"packages/claude-directory/skills/report/SKILL.md",
"packages/claude-directory/skills/retargeting-sequence-designer/SKILL.md",
"packages/claude-directory/skills/roas-calculator/SKILL.md",
"packages/claude-directory/skills/seasonal-budget-planner/SKILL.md",
"packages/claude-directory/skills/ugc-creative-brief/SKILL.md",
"packages/claude-directory/skills/utm-builder/SKILL.md",
"packages/claude-directory/skills/video-ad-scriptwriter/SKILL.md",
"packages/claude-directory/tools/directory-tools.json",
"plugin.json",
"scripts/build-packages.py",
"scripts/build-zip.sh",
"scripts/test_build_packages.py",
"scripts/validate-manifests.js",
"scripts/validate-manifests.test.js",
"sdk/README.md",
"skills/ad-copy-generation/SKILL.md",
"skills/campaign-preflight/SKILL.md",
"skills/connect/SKILL.md",
"skills/creative/SKILL.md",
"skills/help/SKILL.md",
"skills/landing-page-creation/SKILL.md",
"skills/launch/SKILL.md",
"skills/llm-visibility-audit/SKILL.md",
"skills/platform-amazon/SKILL.md",
"skills/quickstart/SKILL.md",
"skills/replicate/SKILL.md",
"skills/ugc-creative-brief/SKILL.md"
],
"findings": [],
"summary": "Reviewed the complete frozen 106-file diff and performed the separate explicit workflow bootstrap security review. The prior RSA and bidding finding is resolved across all shipped distributions: shared root sources now remove arbitrary headline quotas and Ad Strength launch gates and retain required conversion bidding; redundant directory overrides are removed. The70-file directory distribution remains byte-identical to its reviewed corrected payload, with no local hooks, executable scripts, SDK or dependency installation, and HTTPS-only remote MCP. Other archives intentionally change to carry the shared correction. Exact-head evidence confirms20Node and10Python tests, strict root/directory validation, clean source identity, archive inventories and hashes. Reviewer independently reran10package tests, directory drift and git diff checks; all passed. Workflow bootstrap inspection found no new privileged PR execution, secret exposure or broader permissions: tag-only release retains a version check, while PR tests are credential-free. Automated protected-path COMMENT behavior is preserved. Source approval does not establish marketplace acceptance, a fresh OAuth/install flow or production deployment."
}Marker: codex-independent-review:3c92684176cee1f82b660ee037aef0b92d86c2fc14ea20a6e74bf2107b198cd8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Build separate version 1.2.1 packages for Claude and OpenAI with the canonical Synter endpoint, original logo, 56 existing skill entry points, and host-specific authentication. The OpenAI update archive preserves the existing identity; the optional
synterarchive supports the new recovery draft while the legacy listing remains intact.Five positive and three negative reviewer prompts were executed in ChatGPT against the existing Synter Review Demo connection. They cover sandbox account inventory, explicit synthetic demo inventory/campaigns/performance, empty tracking evidence, unrelated questions, budget suggestions without mutation, and refusing another company's unconnected private accounts. All eight responses matched the expected behavior. The performance fixture omits currency; metadata now preserves that caveat. These checks do not establish fresh installation, OAuth login, or campaign-mutation coverage.
The 114-second reviewer walkthrough shows the completed host conversation using the existing demo connection. Playback and link-viewer access were verified. Its URL is included in OpenAI review metadata. Private review credentials were saved separately and are absent from the repository.
OpenAI declares OAuth DCR in its vendor authentication extension. Portable base and vendor configuration are validated separately because the current portable MCP schema rejects that extension. The existing Claude developer package retains static session guidance. A generated
packages/claude-directoryfolder and fourth archive provide the directory candidate with 56 skills, six agents and HTTPS MCP only; they contain no local hooks, scripts or SDK. OpenAI packages also contain no local executables or hooks. All shipping profiles now use the same concise RSA guidance without arbitrary headline-count or Ad Strength launch gates, and preserve MAXIMIZE_CONVERSIONS for conversion campaigns. Packaging uses an explicit allowlist, rejects symlinks, verifies ZIP entry bytes, and records source SHA and archive hashes. Full conversation import remains a separate user-initiated export/import capability, not silent history capture by the directory plugin.Validation executed at
ac6b17b0ff15152560ab58b6db804f72de275b9e, clean tree:node --test scripts/validate-manifests.test.js scripts/check-directory-tools.test.js: 20 passed.python3 -m unittest discover -s scripts -p test_build_packages.py: 10 passed.node scripts/validate-manifests.js: passed.node scripts/check-directory-tools.js: 63 instruction files, all 34 referenced tools in the declared directory.python3 scripts/build-packages.py --include-new-draft: four byte-verified packages, each with 56 skills.72fecb572222d3725acd884f4d7f49a3f5493a2c084d4a4ee201a53a960aee73e313a4ed69ef3e2e80d13c622d102e69d8e6c51cfeb8f0ba13f29b2e0340efc15ab905019791b7f0f71033e19e18042e26ba272b7b2d958aac4ff177a7c0f66548bbdbedbc5eb96ffacfcd18b339048139ac6f67dbca160e5fd2d13b7682cd87The new OpenAI draft has accepted the earlier package, authorized OAuth, and discovered 42 tools. The prior package passed all 56 skill checks; the final ac6b17b archive is being uploaded and read back. Domain verification and a finding on the combined custom-goal tool remain unresolved in the live service; their source repairs are consolidated in Synter-Media-AI/synter-media#12227. No production backend deployment has been performed. Existing Claude connector listing remains In review. The new hook-free Claude folder passed structure checks with only three name-confusability holds; revalidation against ac6b17b is underway. Directory terms are approved. The old root-folder draft remains preserved. Neither new package is publicly released. This repository has no staging branch, so this draft targets main.
References: OpenAI MCP authentication, submission configuration, MCP origin rules.