[Zhao0335]

Problem and changes

FastWrite reads task catalog fields from SKILL.md. The upstream Chinese and English skills have their own frontmatter. Read optional FastWrite metadata from an adjacent TASK.md so the Agent selector can list both versions and the provider receives the original instructions.

Users can select either language for draft, continue, and revise tasks. Both files and their MIT license are vendored from Adkid-Zephyr’s pinned upstream commit.

CI maintenance

Follow-up commits address release-check blockers without changing the vendored skills:

• Raise the Nodemailer dependency floor and locked version from 10.0.10 to 10.1.4, the first version resolving all five moderate advisories from the failed production audit. The 10.1.4 release includes the required address-parser fixes. Unrelated dependency versions are unchanged.
• Add the missing scripts/check-source-secrets.ts entry point already called by security-check.sh since 939814a. It checks tracked text files for explicit private-key headers and GitHub token formats, reports only file/line/rule, fails on Git or read errors, and avoids reading through symlinks. Keep the dependency audit and run five new scanner fixture tests. This is a limited source-pattern check, not a comprehensive secret or history scan.
• Update browser smoke assertions to the current Chinese UI and completion toggle button. Scope mode switches separately from similarly named Agent commands. Keep command/API fixture values and behavior checks; replace removed save/undo-button labels with completion-preview and persisted-content checks.
• Fix the selected writing mode's 3.67:1 text contrast by using the existing semantic foreground token. This changes one color declaration and preserves the background and aria-pressed state. The axe checks remain enabled at their original thresholds.

Validation

Full Linux CI passed at 6797f5be2aa7436291e24b497202a84f261478d9:

• Frozen dependency install, real sandboxed LaTeX/PDF/SyncTeX compilation, typecheck, and production build.
• 413 unit tests (2,775 assertions), 11 writing-evaluation cases, and the full security check including five scanner tests (42 assertions).
• All six authenticated-browser stages, including parallel-tab session refresh and offline/access-denial checks.
• The complete main browser smoke, including accessibility, editing and persistence, Agent hunk review/conflicts, memory, targeted review, completions, compilation repair, and GitHub import. The run ends with FastWrite release checks passed.

Additional local checks: mail-delivery and skill-registry tests (8 passed); Nodemailer JSON transport exercised createTransport and sendMail without sending email; both built skills and both licenses matched their source bytes. Selected-mode contrast also passed axe on the actual built UI in both themes and both writing modes (four states).

Local Windows/Bun 1.4.2 testing had three unit failures that passed in isolation and one intermittent cross-tab refresh failure followed by two passing runs. The final Linux/Bun 1.4.3 run above passed without relaxing assertions or timeouts.