All notable changes to LAP (Lean API Platform) will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Registry-controlled command injection -- launch login URLs with shell-free process APIs and validate server-provided authentication URLs before opening them
- Registry URL validation -- require HTTPS except for real loopback development hosts and reject credentials, malformed URLs, and prefix-bypass payloads
- Issue automation SSRF -- stop privileged GitHub runners from fetching reporter-controlled URLs
- Dependency hardening -- update
js-yamland pin GitHub Actions to reviewed commit SHAs
- Codex IDE support -- full
--target codexsupport across all commands: init, skill-install, skill-uninstall, uninstall, check, pin, unpin, diff (Python + TypeScript) skill-uninstallcommand -- remove individual skills by name, with cross-target lookup (all 3 IDEs)uninstallcommand -- fully remove LAP from your IDE: skills, hooks, metadata, CLAUDE.md/AGENTS.md/Cursor rules- Codex curl-first workflow -- generated skills and builtin Codex SKILL.md use curl for registry operations (search, get, check) instead of npx, which is unusably slow in Codex sandbox
- Python
--hookflag --lapsh check --hook claude/cursor/codexoutputs structured JSON for SessionStart hook injection (cross-language parity with TypeScript) - Output sanitization -- TypeScript CLI strips ANSI escapes and control chars from registry data (matches Python)
- Cross-language parity tests -- 3 automated tests (P1-P3) read Python source constants and assert TypeScript matches, preventing drift
- Hook instruction mismatch -- Python and TypeScript
LAP_HOOK_INSTRUCTIONconstants now identical, preventing CLAUDE.md removal failures - Robust markdown removal -- both Python and TypeScript fall back to regex if exact string match fails when removing LAP instruction blocks
- Redundant pin/unpin fallback -- TypeScript
cmdSetPinnednow usesresolveSkillTarget()instead of duplicating cross-target lookup logic
- Hook instruction clarity -- CLAUDE.md and Cursor rule now explicitly tell agents to include diff and pin commands in skill update notifications
- Cursor rule instruction -- aligned with CLAUDE.md instruction wording
- Automatic skill update checking -- SessionStart hook runs
lapsh checkon every new conversation, notifying users of available skill updates - Hook installation --
lapsh initregisters a SessionStart hook in.claude/settings.jsonor.cursor/hooks.json(idempotent, preserves existing hooks) - CLAUDE.md instruction injection --
lapsh initadds a marker-based instruction block to~/.claude/CLAUDE.mdtelling agents to present update notifications - Cursor update rule --
lapsh init --target cursorcreates an always-apply rule in~/.cursor/rules/lap-updates.mdc
lapsh checkcommand -- check installed skills for available updates via batch registry APIlapsh pin/unpincommands -- pin skills to skip update checks, unpin to resumelapsh diffcommand -- diff installed spec vs registry latest, or two local LAP files[community]badge in CLI search output for community-contributed specs (Python and TypeScript)- TypeScript SDK CI -- added Node 18/20 test matrix in GitHub Actions, npm publish now requires tests to pass
- Search scoring -- registry now scores against provider_slug and provider_domain fields, fixing queries like
discord.comthat previously returned no results - Search weights -- tuned scoring: name 1.0, provider slug 0.85, provider domain 0.7, description 0.7, threshold raised from 0.2 to 0.3
- fuzzyScore -- added empty-string guard to avoid unnecessary computation on specs with missing provider fields
lapsh initcommand -- set up LAP in your IDE with one command. Auto-installs the bundled LAP skill to the correct directory- Cursor IDE support --
--target cursorflag forskill,skill-batch,skill-install, andinitcommands. Generates.mdcfiles with Cursor-specific frontmatter - IDE auto-detection --
de 8000 tect_target()checks TERM_PROGRAM, CURSOR_TRACE_ID, PATH, project directories, and home directory to auto-detect Claude vs Cursor --versionflag for both Python and TypeScript CLIs- Full TypeScript SDK compiler parity -- all 6 compilers (AsyncAPI, GraphQL, Postman, Protobuf, AWS SDK, Smithy) now available in TypeScript with comprehensive tests
- Cursor skill rule (
skills/cursor/lap.mdc) -- dedicated skill file for Cursor withskill-install --target cursorinstructions - CLI section in generated skills -- every generated skill now includes a
## CLIsection with npx commands for updating and searching
skill-installnow fetches LAP spec from registry and generates skills locally (instead of downloading pre-built bundles), enabling target-aware outputSkillOutputnow includesmain_filefield -- callers useskill.file_map[skill.main_file]instead of hardcoded"SKILL.md"- Improved
_slugify()to handle/and.characters - Reduced integration test corpus from 29 to 8 representative specs (test suite runs 4x faster)
replaceSection()in TypeScript now preserves original section name instead of hardcoding "Enhanced Skill Content"
- HTML tag leakage in @desc fields -- descriptions from upstream API specs were leaking raw HTML tags and entities into compiled LAP output
- Missing
Pathimport inskill.py--detect_target()would crash at runtime - Home directory validation -- Cursor target path in TypeScript
cmdInitno longer silently uses empty string when HOME/USERPROFILE are unset - Security: Smithy compiler uses
execFileSyncinstead ofexecSyncto prevent command injection
- HTML tag leakage in @desc fields: Descriptions from upstream API specs (Etsy, eBay, AWS, Stripe, Azure, etc.) were leaking raw HTML tags and entities into compiled LAP output
- Move
_strip_htmlto sharedstrip_htmlinutils.pywithhtml.unescape()to handle both raw tags and HTML entities (<,>, etc.) - Apply HTML stripping to all compilers: TypeScript OpenAPI, Python Postman, and Python Smithy (previously only Python OpenAPI had it)
- HTML entity decoding tests for the shared
strip_htmlutility - Postman compiler HTML stripping tests
- TypeScript OpenAPI HTML stripping tests (params, summaries, responses, request body, entities)
lapsh get <name>: Download a LAP spec from the registry by name- Supports
-ofor file output and--leanfor lean variant - Available in both Python and TypeScript CLIs
- Supports
- Provider domain in search output: Text search results now show the provider domain (e.g.
stripe.com) as a column between name and endpoints urlfield in JSON search results: Each result now includes the full registry URL for fetching the spec
- Add
User-Agentheader togetcommand to prevent Cloudflare 403 errors
- Wire up
searchcommand in TypeScript CLI (was missing from dispatcher) - TS CLI now supports:
lapsh search <query> [--tag] [--sort] [--limit] [--offset] [--json]
- Registry search:
lapsh search <query>-- search the LAP registry for APIs- Supports
--tag,--sort,--limit,--offset,--jsonflags - Output sanitization against ANSI injection from server responses
- Pagination hints when more results available
- Supports
- TypeScript SDK search:
LAPClient.search()method for registry search - Search test coverage: 64 Python tests + 6 TypeScript tests
- TS SDK
fromRegistry()used wrong URL path (/specs/->/v1/apis/) - TypeScript SDK
SearchResponsetype and parser exports
Skipped -- internal build number consumed during development; no public release.
- Add User-Agent header to registry API requests to prevent blocked skill installs
- Default skill generation no longer auto-detects L2 (AI-enhanced). Defaults to L1 (mechanical). Use
--aito opt in.
- AWS SDK JSON compiler: Compile AWS SDK service definitions (~300 AWS services)
- Auto-detection integrated into
detect_format()andcompile()pipeline - Maps operations, shapes, auth, and metadata to LAP format
- Auto-detection integrated into
- Skill generation (Layer 1 + Layer 2)
lapsh skill <spec>-- generate a Claude Code skill from any API speclapsh skill-batch <dir>-- batch generate skills from a directorylapsh benchmark-skill/benchmark-skill-all-- token usage benchmarks- Layer 1: mechanical generation (no LLM), Layer 2: optional LLM enhancement
- 3000-token budget per skill, generates SKILL.md + embedded LAP spec
- TypeScript SDK expansion: OpenAPI compiler, serializer, and skill compiler ported to TypeScript
- YAML compatibility module (
yaml_compat.py): handles bare=tags, restricts booleans to true/false, tolerates unknown tags - Auth inference from descriptions: last-resort auth detection by scanning
info.descriptionfor auth keywords
- Consolidated shared code to
utils.py--AUTH_PARAM_NAMES,AUTH_DESC_KEYWORDS,resolve_ref()extracted from duplicate implementations across compilers - Removed dead
main()/if __name__blocks from compiler modules graphql-corepromoted from optional to required dependency- Response schema depth increased from 2 to 3 levels, inline depth from 1 to 2
- Auth param set updated: removed false-positive-prone bare "key", added Azure subscription-key variants and
x-auth-token - All asset images updated to 300 DPI
- Swagger 2.0
securityDefinitionsnot recognized;host/basePathextraction for base URL - HTTP auth scheme "basic" producing "Bearer basic" instead of "Basic"
- HTML tags leaking into compiled descriptions (now stripped)
tiktokenerrors on special tokens (disallowed_special=())- "API API" doubling in skill descriptions when api_name ends with "API"
- Hardened all compilers (OpenAPI, AsyncAPI, Postman, Skill) against malformed specs: type arrays, missing param names, cycle detection in $ref resolution
- YAML 1.1 edge cases: bare
=value tag, YES/NO/ON/OFF boolean false positives
- Skill version override and API version surfaced in body
- GitHub Actions workflows for PyPI and npm publishing
- TypeScript SDK published as
@lap-platform/lapsh - Expanded README with concrete compression examples
- CLI entry point renamed to
lapsh - All package versions aligned to 0.3.0
- Parser roundtrip failures for complex specs
- CLI unicode output on Windows (cp1255)
- AWS Smithy support: Complete implementation of Smithy IDL compiler
- Accepts Smithy JSON AST files (
.json) - Accepts Smithy IDL files (
.smithy) via Smithy CLI - Accepts Smithy project directories with
smithy-build.json - Format auto-detection for Smithy specs
- Full HTTP binding extraction (@http, @httpLabel, @httpQuery, @httpHeader)
- Complete type system support (scalars, collections, structures, enums, maps)
- Auth scheme mapping (AWS SigV4, Bearer, ApiKey, HTTP Basic)
- Response and error schema generation
- 60 comprehensive tests with 100% pass rate
- Accepts Smithy JSON AST files (
- Example Weather service in Smithy format (
examples/verbose/smithy/weather.json) - Smithy implementation documentation (
docs/smithy-implementation-summary.md)
- Updated format detection in
core/compilers/__init__.pyto include Smithy - Updated CLI format choices to include "smithy"
- Enhanced compiler infrastructure to support protocol-agnostic IDLs
- No new dependencies required (uses stdlib only)
- Optional Smithy CLI for
.smithyfile conversion - Maintains backward compatibility with all existing formats
- Compression ratio: ~2.3x (standard), ~2.9x (lean) for Smithy specs
- Initial release of LAP (Lean API Platform)
- Support for OpenAPI/Swagger specs
- Support for GraphQL schemas (SDL and introspection JSON)
- Support for AsyncAPI specs
- Support for Protocol Buffers (.proto files)
- Support for Postman collections
- CLI with compile, validate, convert, diff, and benchmark commands
- LAP format v0.3 with @common_fields directive
- Token counting and compression metrics
- Integration with LangChain, CrewAI, OpenAI
- Python SDK
- Comprehensive test suite (800+ tests)