Generated by the improve skill on 2026-07-14, audited against commit c75c3b9
(branch chatty-wolves-lead). Each plan is self-contained and written for an
executor with no prior context. Executor: read the whole plan before starting,
honor its STOP conditions, run the drift check first, and update your row below
when done.
| Plan | Title | Priority | Effort | Depends on | Status |
|---|---|---|---|---|---|
| 001 | Establish a Vitest unit-test baseline | P1 | S | — | DONE |
| 002 | Add a root AGENTS.md | P2 | S | — | DONE |
| 003 | Fix uninstallNuxtModule (removes wrong module → config data loss) |
P1 | S | 001 | DONE |
| 004 | Fix options RPC cache (inverted guard + shared-constant mutation) | P1 | S | 001 | DONE |
| 005 | Harden assets RPC (path containment + collision-filename bug) | P1 | S–M | 001 | TODO |
| 006 | Enforce storage denylist on item access (not just listing) | P1 | S | 001 | TODO |
| 007 | Fix fn-metric metadata + server-data environments bug |
P2 | S | 001 | TODO |
| 008 | Fix v4 migration guide enablePages example |
P2 | S | — | TODO |
| 009 | Remove dead auth-migration code | P2 | S | 001 | TODO |
Status values: TODO | IN PROGRESS | DONE | BLOCKED (one-line reason) | REJECTED (one-line rationale)
- First: 001 (unblocks 003–007 and 009 — they add tests / rely on
pnpm test:unit). - Then, in parallel or any order: 003, 004, 005, 006, 007 (independent files; each depends only on 001). 002 and 008 are standalone and can be done anytime.
- 009 after 001; low code risk but MED overall (touches shared constant + build).
- 003, 004, 005, 006, 007, 009 depend on 001 because each writes a
pnpm test:unittest (003–007) or relies on the unit suite as its regression net (009). Landing 001 first means the risky RPC fixes are validated test-first, per the chosen ordering. - 003/004/005/006/007 touch different files, so they do not conflict with each other and can be executed concurrently once 001 lands.
- 002 (AGENTS.md) and 008 (docs) have no code dependencies.
- Plan 005 bundles three assets-RPC findings that all live in
server-rpc/assets.ts(write-containment bypass, read/delete/rename with no containment, and the collision-filename bug) so two plans don't edit the same file. - Plan 007 bundles two unrelated one-line correctness bugs in different files.
- Plan 009 bundles the safe dead-code removals (unused
dev-auth.ts, duplicategetServerConfig,disableAuthorizationdefault). Removing the deprecated public exports and dead UI branches is deferred inside 009's Maintenance notes as a breaking maintainer-owned follow-up.
- "DevTools reads/writes the filesystem & shells out to package managers" as a vulnerability — by-design for an explicitly-local dev tool. Only the intent-vs-implementation gaps (storage denylist, write containment) and the read/delete containment asymmetry became plans (005, 006).
- Nitro inline
<script>injection — the injected body is a static build-time constant with no user interpolation. Not a finding. - Subprocess shell injection —
tinyexecis invoked with an argv array, no shell. Only low-priority argument-injection (leading-dash package names) remains; not planned. renovate: false+catalog:pins on 0.x@vitejs/devtools— deliberate posture for a fast-moving alpha, not a defect.
From the advisor report table/notes, still open and un-planned:
onDevtoolsClientConnected dead hasSetup guard (devtools-kit/runtime/iframe-client.ts:6);
subprocess restart race (devtools-kit/src/index.ts:74-98); uncleaned 500ms
setInterval (runtime/plugins/view/client.ts:312); timeline promise wrapper
unhandled-rejection branch; clearOptions leaves per-tab files; duplicated
cache/watch/debounce scaffolding across 3 RPC scanners; ~54 any on the untyped
devtools-kit RPC boundary; stale contributing doc (pnpm v8); the RPC compat-shim
retirement (Direction D3, L). Ask to turn any of these into plans.