2026-02-16 13:53:54 +00:00
|
|
|
module forge.lthn.ai/core/go
|
2025-10-24 04:55:10 +01:00
|
|
|
|
2026-02-22 20:33:48 +00:00
|
|
|
go 1.26.0
|
2025-10-24 04:55:10 +01:00
|
|
|
|
|
|
|
|
require (
|
2026-02-22 21:40:25 +00:00
|
|
|
forge.lthn.ai/Snider/Borg v0.2.1
|
2026-02-23 06:49:46 +00:00
|
|
|
forge.lthn.ai/core/cli v0.0.4
|
|
|
|
|
forge.lthn.ai/core/go-crypt v0.0.3
|
|
|
|
|
forge.lthn.ai/core/go-devops v0.0.3
|
2026-02-16 13:53:54 +00:00
|
|
|
github.com/aws/aws-sdk-go-v2 v1.41.1
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.96.0
|
|
|
|
|
github.com/gorilla/websocket v1.5.3
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/spf13/viper v1.21.0
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/stretchr/testify v1.11.1
|
2026-02-16 13:53:54 +00:00
|
|
|
golang.org/x/crypto v0.48.0
|
|
|
|
|
golang.org/x/text v0.34.0
|
2026-02-17 21:39:49 +00:00
|
|
|
google.golang.org/grpc v1.79.1
|
|
|
|
|
google.golang.org/protobuf v1.36.11
|
2026-01-29 18:13:51 +00:00
|
|
|
gopkg.in/yaml.v3 v3.0.1
|
2026-02-21 19:11:03 +00:00
|
|
|
modernc.org/sqlite v1.46.1
|
2025-10-24 04:55:10 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
|
|
require (
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
github.com/ProtonMail/go-crypto v1.3.0 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.8 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.17 // indirect
|
|
|
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.17 // indirect
|
|
|
|
|
github.com/aws/smithy-go v1.24.0 // indirect
|
2026-02-21 18:08:02 +00:00
|
|
|
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
|
2026-02-22 23:08:03 +00:00
|
|
|
github.com/charmbracelet/bubbletea v1.3.10 // indirect
|
2026-02-23 06:35:19 +00:00
|
|
|
github.com/charmbracelet/colorprofile v0.4.2 // indirect
|
2026-02-22 21:40:25 +00:00
|
|
|
github.com/charmbracelet/lipgloss v1.1.1-0.20250404203927-76690c660834 // indirect
|
2026-02-23 06:35:19 +00:00
|
|
|
github.com/charmbracelet/x/ansi v0.11.6 // indirect
|
|
|
|
|
github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
|
2026-02-22 21:40:25 +00:00
|
|
|
github.com/charmbracelet/x/term v0.2.2 // indirect
|
2026-02-23 06:35:19 +00:00
|
|
|
github.com/clipperhouse/displaywidth v0.11.0 // indirect
|
|
|
|
|
github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
|
feat(mcp): add workspace root validation to prevent path traversal (#100)
* feat(mcp): add workspace root validation to prevent path traversal
- Add workspaceRoot field to Service for restricting file operations
- Add WithWorkspaceRoot() option for configuring the workspace directory
- Add validatePath() helper to check paths are within workspace
- Apply validation to all file operation handlers
- Default to current working directory for security
- Add comprehensive tests for path validation
Closes #82
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor: move CLI commands from pkg/ to internal/cmd/
- Move 18 CLI command packages to internal/cmd/ (not externally importable)
- Keep 16 library packages in pkg/ (externally importable)
- Update all import paths throughout codebase
- Cleaner separation between CLI logic and reusable libraries
CLI commands moved: ai, ci, dev, docs, doctor, gitcmd, go, monitor,
php, pkgcmd, qa, sdk, security, setup, test, updater, vm, workspace
Libraries remaining: agentic, build, cache, cli, container, devops,
errors, framework, git, i18n, io, log, mcp, process, release, repos
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(mcp): use pkg/io Medium for sandboxed file operations
Replace manual path validation with pkg/io.Medium for all file operations.
This delegates security (path traversal, symlink bypass) to the sandboxed
local.Medium implementation.
Changes:
- Add io.NewSandboxed() for creating sandboxed Medium instances
- Refactor MCP Service to use io.Medium instead of direct os.* calls
- Remove validatePath and resolvePathWithSymlinks functions
- Update tests to verify Medium-based behaviour
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: correct import path and workflow references
- Fix pkg/io/io.go import from core-gui to core
- Update CI workflows to use internal/cmd/updater path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(security): address CodeRabbit review issues for path validation
- pkg/io/local: add symlink resolution and boundary-aware containment
- Reject absolute paths in sandboxed Medium
- Use filepath.EvalSymlinks to prevent symlink bypass attacks
- Fix prefix check to prevent /tmp/root matching /tmp/root2
- pkg/mcp: fix resolvePath to validate and return errors
- Changed resolvePath from (string) to (string, error)
- Update deleteFile, renameFile, listDirectory, fileExists to handle errors
- Changed New() to return (*Service, error) instead of *Service
- Properly propagate option errors instead of silently discarding
- pkg/io: wrap errors with E() helper for consistent context
- Copy() and MockMedium.Read() now use coreerr.E()
- tests: rename to use _Good/_Bad/_Ugly suffixes per coding guidelines
- Fix hardcoded /tmp in TestPath to use t.TempDir()
- Add TestResolvePath_Bad_SymlinkTraversal test
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style: fix gofmt formatting across all files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 21:59:34 +00:00
|
|
|
github.com/cloudflare/circl v1.6.3 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
2026-02-21 18:08:02 +00:00
|
|
|
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
feat: wire release command, add tar.xz support, unified installers (#277)
* feat(cli): wire release command and add installer scripts
- Wire up `core build release` subcommand (was orphaned)
- Wire up `core monitor` command (missing import in full variant)
- Add installer scripts for Unix (.sh) and Windows (.bat)
- setup: Interactive with variant selection
- ci: Minimal for CI/CD environments
- dev: Full development variant
- go/php/agent: Targeted development variants
- All scripts include security hardening:
- Secure temp directories (mktemp -d)
- Architecture validation
- Version validation after GitHub API call
- Proper cleanup on exit
- PowerShell PATH updates on Windows (avoids setx truncation)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(build): add tar.xz support and unified installer scripts
- Add tar.xz archive support using Borg's compress package
- ArchiveXZ() and ArchiveWithFormat() for configurable compression
- Better compression ratio than gzip for release artifacts
- Consolidate 12 installer scripts into 2 unified scripts
- install.sh and install.bat with BunnyCDN edge variable support
- Subdomains: setup.core.help, ci.core.help, dev.core.help, etc.
- MODE and VARIANT transformed at edge based on subdomain
- Installers prefer tar.xz with automatic fallback to tar.gz
- Fixed CodeRabbit issues: HTTP status patterns, tar error handling,
verify_install params, VARIANT validation, CI PATH persistence
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: add build and release config files
- .core/build.yaml - cross-platform build configuration
- .core/release.yaml - release workflow configuration
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* chore: move plans from docs/ to tasks/
Consolidate planning documents in tasks/plans/ directory.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(install): address CodeRabbit review feedback
- Add curl timeout (--max-time) to prevent hanging on slow networks
- Rename TMPDIR to WORK_DIR to avoid clobbering system env var
- Add chmod +x to ensure binary has execute permissions
- Add error propagation after subroutine calls in batch file
- Remove System32 install attempt in CI mode (use consistent INSTALL_DIR)
- Fix HTTP status regex for HTTP/2 compatibility
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(rag): add Go RAG implementation with Qdrant + Ollama
Add RAG (Retrieval Augmented Generation) tools for storing documentation
in Qdrant vector database and querying with semantic search. This replaces
the Python tools/rag implementation with a native Go solution.
New commands:
- core rag ingest [directory] - Ingest markdown files into Qdrant
- core rag query [question] - Query vector database with semantic search
- core rag collections - List and manage Qdrant collections
Features:
- Markdown chunking by sections and paragraphs with overlap
- UTF-8 safe text handling for international content
- Automatic category detection from file paths
- Multiple output formats: text, JSON, LLM context injection
- Environment variable support for host configuration
Dependencies:
- github.com/qdrant/go-client (gRPC client)
- github.com/ollama/ollama/api (embeddings API)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(deploy): add pure-Go Ansible executor and Coolify API integration
Implement infrastructure deployment system with:
- pkg/ansible: Pure Go Ansible executor
- Playbook/inventory parsing (types.go, parser.go)
- Full execution engine with variable templating, loops, blocks,
conditionals, handlers, and fact gathering (executor.go)
- SSH client with key/password auth and privilege escalation (ssh.go)
- 35+ module implementations: shell, command, copy, template, file,
apt, service, systemd, user, group, git, docker_compose, etc. (modules.go)
- pkg/deploy/coolify: Coolify API client wrapping Python swagger client
- List/get servers, projects, applications, databases, services
- Generic Call() for any OpenAPI operation
- pkg/deploy/python: Embedded Python runtime for swagger client integration
- internal/cmd/deploy: CLI commands
- core deploy servers/projects/apps/databases/services/team
- core deploy call <operation> [params-json]
This enables Docker-free infrastructure deployment with Ansible-compatible
playbooks executed natively in Go.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(deploy): address linter warnings and build errors
- Fix fmt.Sprintf format verb error in ssh.go (remove unused stat command)
- Fix errcheck warnings by explicitly ignoring best-effort operations
- Fix ineffassign warning in cmd_ansible.go
All golangci-lint checks now pass for deploy packages.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* style(deploy): fix gofmt formatting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(deploy): use known_hosts for SSH host key verification
Address CodeQL security alert by using the user's known_hosts file
for SSH host key verification when available. Falls back to accepting
any key only when known_hosts doesn't exist (common in containerized
or ephemeral environments).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat(ai,security,ide): add agentic MVP, security jobs, and Core IDE desktop app
Wire up AI infrastructure with unified pkg/ai package (metrics JSONL,
RAG integration), move RAG under `core ai rag`, add `core ai metrics`
command, and enrich task context with Qdrant documentation.
Add `--target` flag to all security commands for external repo scanning,
`core security jobs` for distributing findings as GitHub Issues, and
consistent error logging across scan/deps/alerts/secrets commands.
Add Core IDE Wails v3 desktop app with Angular 20 frontend, MCP bridge
(loopback-only HTTP server), WebSocket hub, and Claude Code bridge.
Production-ready with Lethean CIC branding, macOS code signing support,
and security hardening (origin validation, body size limits, URL scheme
checks, memory leak prevention, XSS mitigation).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: address PR review comments from CodeRabbit, Copilot, and Gemini
Fixes across 25 files addressing 46+ review comments:
- pkg/ai/metrics.go: handle error from Close() on writable file handle
- pkg/ansible: restore loop vars after loop, restore become settings,
fix Upload with become=true and no password (use sudo -n), honour
SSH timeout config, use E() helper for contextual errors, quote git
refs in checkout commands
- pkg/rag: validate chunk config, guard negative-to-uint64 conversion,
use E() helper for errors, add context timeout to Ollama HTTP calls
- pkg/deploy/python: fix exec.ExitError type assertion (was os.PathError),
handle os.UserHomeDir() error
- pkg/build/buildcmd: use cmd.Context() instead of context.Background()
for proper Ctrl+C cancellation
- install.bat: add curl timeouts, CRLF line endings, use --connect-timeout
for archive downloads
- install.sh: use absolute path for version check in CI mode
- tools/rag: fix broken ingest.py function def, escape HTML in query.py,
pin qdrant-client version, add markdown code block languages
- internal/cmd/rag: add chunk size validation, env override handling
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(build): make release dry-run by default and remove darwin/amd64 target
Replace --dry-run (default false) with --we-are-go-for-launch (default
false) so `core build release` is safe by default. Remove darwin/amd64
from default build targets (arm64 only for macOS). Fix cmd_project.go
to use command context instead of context.Background().
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-04 00:49:57 +00:00
|
|
|
github.com/google/uuid v1.6.0 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
2026-02-22 21:40:25 +00:00
|
|
|
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
|
2026-02-04 00:56:39 +00:00
|
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
2026-02-21 18:08:02 +00:00
|
|
|
github.com/mattn/go-localereader v0.0.1 // indirect
|
2026-02-23 06:35:19 +00:00
|
|
|
github.com/mattn/go-runewidth v0.0.20 // indirect
|
2026-02-21 18:08:02 +00:00
|
|
|
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
|
|
|
|
|
github.com/muesli/cancelreader v0.2.2 // indirect
|
|
|
|
|
github.com/muesli/termenv v0.16.0 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
2026-02-21 18:08:02 +00:00
|
|
|
github.com/rivo/uniseg v0.4.7 // indirect
|
refactor: strip to pure package library (#3)
- Fix remaining 187 pkg/ files referencing core/cli → core/go
- Move SDK library code from internal/cmd/sdk/ → pkg/sdk/ (new package)
- Create pkg/rag/helpers.go with convenience functions from internal/cmd/rag/
- Fix pkg/mcp/tools_rag.go to use pkg/rag instead of internal/cmd/rag
- Fix pkg/build/buildcmd/cmd_sdk.go and pkg/release/sdk.go to use pkg/sdk
- Remove all non-library content: main.go, internal/, cmd/, docker/,
scripts/, tasks/, tools/, .core/, .forgejo/, .woodpecker/, Taskfile.yml
- Run go mod tidy to trim unused dependencies
core/go is now a pure Go package suite (library only).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/3
2026-02-16 14:23:45 +00:00
|
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
|
|
|
github.com/spf13/cast v1.10.0 // indirect
|
2026-02-22 23:08:03 +00:00
|
|
|
github.com/spf13/cobra v1.10.2 // indirect
|
2026-01-29 18:13:51 +00:00
|
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
2026-02-21 18:08:02 +00:00
|
|
|
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
|
2026-02-22 21:40:25 +00:00
|
|
|
go.opentelemetry.io/otel v1.40.0 // indirect
|
|
|
|
|
go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
|
2026-02-05 10:26:44 +00:00
|
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
2026-02-23 06:35:19 +00:00
|
|
|
golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa // indirect
|
2026-02-19 14:41:53 +00:00
|
|
|
golang.org/x/net v0.50.0 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
golang.org/x/sys v0.41.0 // indirect
|
2026-02-22 23:08:03 +00:00
|
|
|
golang.org/x/term v0.40.0 // indirect
|
2026-02-16 13:53:54 +00:00
|
|
|
gonum.org/v1/gonum v0.17.0 // indirect
|
2026-02-17 21:09:40 +00:00
|
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
|
refactor: strip 25 extracted packages, slim to foundation (#5)
## Summary
- Remove 25 packages extracted to domain repos (go-crypt, go-ai, go-devops, go-scm, go-netops)
- Make crypt service registration optional in CLI framework
- core/go is now a pure foundation library (~24K LOC, 17 packages)
## Remaining packages
cache, cli, config, framework, help, i18n, io, lab, log, plugin, process, ratelimit, repos, session, webview, workspace, ws
Co-authored-by: Claude <developers@lethean.io>
Reviewed-on: https://forge.lthn.ai/core/go/pulls/5
Co-authored-by: Charon <charon@lthn.ai>
Co-committed-by: Charon <charon@lthn.ai>
2026-02-16 15:37:06 +00:00
|
|
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
2026-02-23 06:35:19 +00:00
|
|
|
modernc.org/libc v1.68.0 // indirect
|
2026-02-05 20:45:45 +00:00
|
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
|
|
|
modernc.org/memory v1.11.0 // indirect
|
2025-10-24 04:55:10 +01:00
|
|
|
)
|
