Commit graph

4 commits

Author SHA1 Message Date
Virgil
ae0677a046 fix(security): harden installer, marketplace, and sync path handling
Co-Authored-By: Virgil <virgil@lethean.io>
2026-03-23 14:32:11 +00:00
Claude
2dcb86738a
chore: migrate to dappco.re vanity import path
Some checks failed
Security Scan / security (push) Failing after 8s
Test / test (push) Failing after 22s
Change module path from forge.lthn.ai/core/go-scm to dappco.re/go/core/scm.
Update all Go source imports for migrated packages:
- go-log  -> dappco.re/go/core/log
- go-io   -> dappco.re/go/core/io
- go-i18n -> dappco.re/go/core/i18n
- go-ws   -> dappco.re/go/core/ws
- api     -> dappco.re/go/core/api

Non-migrated packages (cli, config) left on forge.lthn.ai paths.
Replace directives use local paths (../go, ../go-io, etc.) until the
dappco.re vanity URL server resolves these modules.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 23:54:23 +00:00
Snider
10c9e23e04 fix(dx): repair build, update CLAUDE.md, add tests for untested paths
Some checks failed
Security Scan / security (pull_request) Failing after 9s
Test / test (pull_request) Successful in 1m44s
- Fix cmd/forge build failure: remove extra locales.FS arg from
  RegisterCommands (signature takes single CommandRegistration)
- Update CLAUDE.md error handling section to document coreerr.E()
  pattern (was outdated log.E/fmt.Errorf reference)
- Add security_test.go for agentci: SanitizePath, EscapeShellArg,
  SecureSSHCommand, MaskToken (coverage 56% → 68%)
- Add provider_handlers_test.go for pkg/api: category filter, nil
  guards, manifest/verify/sign bad requests (coverage 31% → 52%)
- Audit confirms: no fmt.Errorf or os.ReadFile/WriteFile in production
  code (only in test files)

Co-Authored-By: Virgil <virgil@lethean.io>
2026-03-17 08:49:55 +00:00
Snider
81deee8598 feat(api): add SCM service provider with Lit custom elements
Some checks failed
Security Scan / security (push) Failing after 7s
Test / test (push) Failing after 1m16s
ScmProvider implements Provider + Streamable + Describable + Renderable,
wrapping marketplace, manifest, installed, and registry endpoints as REST
API with WS event streaming. Includes Lit custom element bundle with
panel, marketplace browser, manifest viewer, installed manager, and
registry status display. All 14 tests pass.

Co-Authored-By: Virgil <virgil@lethean.io>
2026-03-14 10:42:37 +00:00