2026-02-16 13:53:54 +00:00
|
|
|
module forge.lthn.ai/core/go
|
2025-10-24 04:55:10 +01:00
|
|
|
|
refactor(cli): restructure cmd packages into subdirectories
- Move CLI commands into subdirectories matching command hierarchy:
dev/, go/, php/, build/, ci/, sdk/, pkg/, vm/, docs/, setup/, doctor/, test/, ai/
- Create shared/ package for common styles and utilities
- Add new `core ai` root command with claude subcommand
- Update package declarations and imports across all files
- Create commands.go entry points for each package
- Remove GUI-related files (moved to core-gui repo)
This makes the filesystem structure match the CLI command structure,
improving context capture and code organization.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 18:02:43 +00:00
|
|
|
go 1.25.5
|
2025-10-24 04:55:10 +01:00
|
|
|
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
require forge.lthn.ai/core/go-crypt v0.0.0
|
|
|
|
|
|
2025-10-24 04:55:10 +01:00
|
|
|
require (
|
feat: infrastructure packages and lint cleanup (#281)
* ci: consolidate duplicate workflows and merge CodeQL configs
Remove 17 duplicate workflow files that were split copies of the
combined originals. Each family (CI, CodeQL, Coverage, PR Build,
Alpha Release) had the same job duplicated across separate
push/pull_request/schedule/manual trigger files.
Merge codeql.yml and codescan.yml into a single codeql.yml with
a language matrix covering go, javascript-typescript, python,
and actions — matching the previous default setup coverage.
Remaining workflows (one per family):
- ci.yml (push + PR + manual)
- codeql.yml (push + PR + schedule, all languages)
- coverage.yml (push + PR + manual)
- alpha-release.yml (push + manual)
- pr-build.yml (PR + manual)
- release.yml (tag push)
- agent-verify.yml, auto-label.yml, auto-project.yml
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: add collect, config, crypt, plugin packages and fix all lint issues
Add four new infrastructure packages with CLI commands:
- pkg/config: layered configuration (defaults → file → env → flags)
- pkg/crypt: crypto primitives (Argon2id, AES-GCM, ChaCha20, HMAC, checksums)
- pkg/plugin: plugin system with GitHub-based install/update/remove
- pkg/collect: collection subsystem (GitHub, BitcoinTalk, market, papers, excavate)
Fix all golangci-lint issues across the entire codebase (~100 errcheck,
staticcheck SA1012/SA1019/ST1005, unused, ineffassign fixes) so that
`core go qa` passes with 0 issues.
Closes #167, #168, #170, #250, #251, #252, #253, #254, #255, #256
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 11:34:43 +00:00
|
|
|
github.com/Snider/Borg v0.2.0
|
2026-02-16 13:53:54 +00:00
|
|
|
github.com/aws/aws-sdk-go-v2 v1.41.1
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0
|
|
|
|
|
github.com/gorilla/websocket v1.5.3
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/spf13/cobra v1.10.2
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/spf13/viper v1.21.0
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/stretchr/testify v1.11.1
|
2026-02-16 13:53:54 +00:00
|
|
|
golang.org/x/crypto v0.48.0
|
|
|
|
|
golang.org/x/term v0.40.0
|
|
|
|
|
golang.org/x/text v0.34.0
|
2026-01-29 18:13:51 +00:00
|
|
|
gopkg.in/yaml.v3 v3.0.1
|
2026-02-16 13:53:54 +00:00
|
|
|
modernc.org/sqlite v1.45.0
|
2025-10-24 04:55:10 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
require (
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
github.com/ProtonMail/go-crypto v1.3.0 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect
|
|
|
|
|
github.com/aws/smithy-go v1.24.0 // indirect
|
feat(mcp): add workspace root validation to prevent path traversal (#100)
* feat(mcp): add workspace root validation to prevent path traversal
- Add workspaceRoot field to Service for restricting file operations
- Add WithWorkspaceRoot() option for configuring the workspace directory
- Add validatePath() helper to check paths are within workspace
- Apply validation to all file operation handlers
- Default to current working directory for security
- Add comprehensive tests for path validation
Closes #82
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move CLI commands from pkg/ to internal/cmd/
- Move 18 CLI command packages to internal/cmd/ (not externally importable)
- Keep 16 library packages in pkg/ (externally importable)
- Update all import paths throughout codebase
- Cleaner separation between CLI logic and reusable libraries
CLI commands moved: ai, ci, dev, docs, doctor, gitcmd, go, monitor,
php, pkgcmd, qa, sdk, security, setup, test, updater, vm, workspace
Libraries remaining: agentic, build, cache, cli, container, devops,
errors, framework, git, i18n, io, log, mcp, process, release, repos
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(mcp): use pkg/io Medium for sandboxed file operations
Replace manual path validation with pkg/io.Medium for all file operations.
This delegates security (path traversal, symlink bypass) to the sandboxed
local.Medium implementation.
Changes:
- Add io.NewSandboxed() for creating sandboxed Medium instances
- Refactor MCP Service to use io.Medium instead of direct os.* calls
- Remove validatePath and resolvePathWithSymlinks functions
- Update tests to verify Medium-based behaviour
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct import path and workflow references
- Fix pkg/io/io.go import from core-gui to core
- Update CI workflows to use internal/cmd/updater path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): address CodeRabbit review issues for path validation
- pkg/io/local: add symlink resolution and boundary-aware containment
- Reject absolute paths in sandboxed Medium
- Use filepath.EvalSymlinks to prevent symlink bypass attacks
- Fix prefix check to prevent /tmp/root matching /tmp/root2
- pkg/mcp: fix resolvePath to validate and return errors
- Changed resolvePath from (string) to (string, error)
- Update deleteFile, renameFile, listDirectory, fileExists to handle errors
- Changed New() to return (*Service, error) instead of *Service
- Properly propagate option errors instead of silently discarding
- pkg/io: wrap errors with E() helper for consistent context
- Copy() and MockMedium.Read() now use coreerr.E()
- tests: rename to use _Good/_Bad/_Ugly suffixes per coding guidelines
- Fix hardcoded /tmp in TestPath to use t.TempDir()
- Add TestResolvePath_Bad_SymlinkTraversal test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting across all files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 21:59:34 +00:00
|
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
feat: wire release command, add tar.xz support, unified installers (#277)
* feat(cli): wire release command and add installer scripts
- Wire up `core build release` subcommand (was orphaned)
- Wire up `core monitor` command (missing import in full variant)
- Add installer scripts for Unix (.sh) and Windows (.bat)
- setup: Interactive with variant selection
- ci: Minimal for CI/CD environments
- dev: Full development variant
- go/php/agent: Targeted development variants
- All scripts include security hardening:
- Secure temp directories (mktemp -d)
- Architecture validation
- Version validation after GitHub API call
- Proper cleanup on exit
- PowerShell PATH updates on Windows (avoids setx truncation)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(build): add tar.xz support and unified installer scripts
- Add tar.xz archive support using Borg's compress package
- ArchiveXZ() and ArchiveWithFormat() for configurable compression
- Better compression ratio than gzip for release artifacts
- Consolidate 12 installer scripts into 2 unified scripts
- install.sh and install.bat with BunnyCDN edge variable support
- Subdomains: setup.core.help, ci.core.help, dev.core.help, etc.
- MODE and VARIANT transformed at edge based on subdomain
- Installers prefer tar.xz with automatic fallback to tar.gz
- Fixed CodeRabbit issues: HTTP status patterns, tar error handling,
verify_install params, VARIANT validation, CI PATH persistence
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: add build and release config files
- .core/build.yaml - cross-platform build configuration
- .core/release.yaml - release workflow configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: move plans from docs/ to tasks/
Consolidate planning documents in tasks/plans/ directory.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(install): address CodeRabbit review feedback
- Add curl timeout (--max-time) to prevent hanging on slow networks
- Rename TMPDIR to WORK_DIR to avoid clobbering system env var
- Add chmod +x to ensure binary has execute permissions
- Add error propagation after subroutine calls in batch file
- Remove System32 install attempt in CI mode (use consistent INSTALL_DIR)
- Fix HTTP status regex for HTTP/2 compatibility
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(rag): add Go RAG implementation with Qdrant + Ollama
Add RAG (Retrieval Augmented Generation) tools for storing documentation
in Qdrant vector database and querying with semantic search. This replaces
the Python tools/rag implementation with a native Go solution.
New commands:
- core rag ingest [directory] - Ingest markdown files into Qdrant
- core rag query [question] - Query vector database with semantic search
- core rag collections - List and manage Qdrant collections
Features:
- Markdown chunking by sections and paragraphs with overlap
- UTF-8 safe text handling for international content
- Automatic category detection from file paths
- Multiple output formats: text, JSON, LLM context injection
- Environment variable support for host configuration
Dependencies:
- github.com/qdrant/go-client (gRPC client)
- github.com/ollama/ollama/api (embeddings API)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(deploy): add pure-Go Ansible executor and Coolify API integration
Implement infrastructure deployment system with:
- pkg/ansible: Pure Go Ansible executor
- Playbook/inventory parsing (types.go, parser.go)
- Full execution engine with variable templating, loops, blocks,
conditionals, handlers, and fact gathering (executor.go)
- SSH client with key/password auth and privilege escalation (ssh.go)
- 35+ module implementations: shell, command, copy, template, file,
apt, service, systemd, user, group, git, docker_compose, etc. (modules.go)
- pkg/deploy/coolify: Coolify API client wrapping Python swagger client
- List/get servers, projects, applications, databases, services
- Generic Call() for any OpenAPI operation
- pkg/deploy/python: Embedded Python runtime for swagger client integration
- internal/cmd/deploy: CLI commands
- core deploy servers/projects/apps/databases/services/team
- core deploy call <operation> [params-json]
This enables Docker-free infrastructure deployment with Ansible-compatible
playbooks executed natively in Go.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(deploy): address linter warnings and build errors
- Fix fmt.Sprintf format verb error in ssh.go (remove unused stat command)
- Fix errcheck warnings by explicitly ignoring best-effort operations
- Fix ineffassign warning in cmd_ansible.go
All golangci-lint checks now pass for deploy packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style(deploy): fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(deploy): use known_hosts for SSH host key verification
Address CodeQL security alert by using the user's known_hosts file
for SSH host key verification when available. Falls back to accepting
any key only when known_hosts doesn't exist (common in containerized
or ephemeral environments).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(ai,security,ide): add agentic MVP, security jobs, and Core IDE desktop app
Wire up AI infrastructure with unified pkg/ai package (metrics JSONL,
RAG integration), move RAG under `core ai rag`, add `core ai metrics`
command, and enrich task context with Qdrant documentation.
Add `--target` flag to all security commands for external repo scanning,
`core security jobs` for distributing findings as GitHub Issues, and
consistent error logging across scan/deps/alerts/secrets commands.
Add Core IDE Wails v3 desktop app with Angular 20 frontend, MCP bridge
(loopback-only HTTP server), WebSocket hub, and Claude Code bridge.
Production-ready with Lethean CIC branding, macOS code signing support,
and security hardening (origin validation, body size limits, URL scheme
checks, memory leak prevention, XSS mitigation).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: address PR review comments from CodeRabbit, Copilot, and Gemini
Fixes across 25 files addressing 46+ review comments:
- pkg/ai/metrics.go: handle error from Close() on writable file handle
- pkg/ansible: restore loop vars after loop, restore become settings,
fix Upload with become=true and no password (use sudo -n), honour
SSH timeout config, use E() helper for contextual errors, quote git
refs in checkout commands
- pkg/rag: validate chunk config, guard negative-to-uint64 conversion,
use E() helper for errors, add context timeout to Ollama HTTP calls
- pkg/deploy/python: fix exec.ExitError type assertion (was os.PathError),
handle os.UserHomeDir() error
- pkg/build/buildcmd: use cmd.Context() instead of context.Background()
for proper Ctrl+C cancellation
- install.bat: add curl timeouts, CRLF line endings, use --connect-timeout
for archive downloads
- install.sh: use absolute path for version check in CI mode
- tools/rag: fix broken ingest.py function def, escape HTML in query.py,
pin qdrant-client version, add markdown code block languages
- internal/cmd/rag: add chunk size validation, env override handling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(build): make release dry-run by default and remove darwin/amd64 target
Replace --dry-run (default false) with --we-are-go-for-launch (default
false) so `core build release` is safe by default. Remove darwin/amd64
from default build targets (arm64 only for macOS). Fix cmd_project.go
to use command context instead of context.Background().
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 00:49:57 +00:00
|
|
|
github.com/google/uuid v1.6.0 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
2026-02-04 00:56:39 +00:00
|
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
refactor: strip to pure package library (#3)
- Fix remaining 187 pkg/ files referencing core/cli → core/go
- Move SDK library code from internal/cmd/sdk/ → pkg/sdk/ (new package)
- Create pkg/rag/helpers.go with convenience functions from internal/cmd/rag/
- Fix pkg/mcp/tools_rag.go to use pkg/rag instead of internal/cmd/rag
- Fix pkg/build/buildcmd/cmd_sdk.go and pkg/release/sdk.go to use pkg/sdk
- Remove all non-library content: main.go, internal/, cmd/, docker/,
scripts/, tasks/, tools/, .core/, .forgejo/, .woodpecker/, Taskfile.yml
- Run go mod tidy to trim unused dependencies
core/go is now a pure Go package suite (library only).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/3
2026-02-16 14:23:45 +00:00
|
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
|
|
|
github.com/spf13/cast v1.10.0 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
|
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
|
|
|
|
|
golang.org/x/sys v0.41.0 // indirect
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
modernc.org/libc v1.67.7 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
|
|
|
modernc.org/memory v1.11.0 // indirect
|
2025-10-24 04:55:10 +01:00
|
|
|
)
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
|
|
|
|
|
replace forge.lthn.ai/core/go-crypt => ../go-crypt
|
