[isamu]

Summary

Closes #34.

• The bounds check (row < 0 || row > 2 || …) let a fractional value through. row: 1.5 therefore threw a TypeError and failed the whole tool call, and col: 0.5 was reported as "already occupied by undefined".
• The new src/core/position.ts adds isOnBoard(row, col, size), which is true only when both are whole numbers inside the board. playTicTacToe uses it in place of the range comparison, so these moves get the out-of-bounds response. Its text now says the values must be whole numbers.
• This is also the unchecked index CodeQL reports as js/prototype-polluting-assignment (alert 1). A non-number row such as "__proto__" from a JavaScript caller is now rejected before any assignment.
• Adds yarn test (tsx --test tests/*.test.ts, the setup the other plugins use) with tests/position.test.ts, and runs it in CI.

Items to Confirm

• Whether the CodeQL alert closes once this lands on main. CodeQL may not treat Number.isInteger as a sanitizer. The crash itself is fixed either way, as yarn test shows.
• The out-of-bounds message changed from "must be 0-2" to "must be whole numbers from 0 to 2". The LLM reads this text.
• Tests are not part of yarn typecheck. That matches the other plugins; adding them would need @types/node.
• Validating a caller-supplied board is out of scope.

Verification

• yarn format, yarn lint, yarn build, yarn typecheck and yarn test pass.
• With src/core/logic.ts restored to main, the off-board / fractional test goes red.

User Prompt

• Inspect the other plugin repos the same way as GUIChatPluginSpreadsheet, then fix what was found (excluding the scoria backlog this time).

🤖 Generated with Claude Code

work in GUIChatPluginSpreadsheet

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@​4.23.15

View full report

[isamu]

CODEX VERDICT: LGTM\n\nReviewed SHA: 9c314d3\n\n| Axis | Result |\n|---|---|\n| Correctness and edge cases | none |\n| Security (injection / path traversal / code evaluation) | none |\n| Tests: does a test go red if the new behaviour breaks | none |\n| API / schema / wire / on-disk compatibility | none |\n| Consistency with the rest of the codebase | none |\n| Input validation: every caller-controlled row/col shape (negative, fractional, NaN, Infinity, non-number) at every entry point | none |\n| CI: the new test step runs on every matrix cell and cannot pass vacuously | none |\n\nLocal verification: yarn test passed (6/6); yarn typecheck, yarn lint, and yarn build passed. No mutation sweep was run.\n\nFINDINGS COMPLETE: I read every hunk of the diff and this is every finding I have.