Commit graph

52 commits

Author SHA1 Message Date
Snider
feb47c8ea5 feat(menu): add agents group to AdminMenuRegistry
Top-level standalone group positioned right after dashboard,
giving the agentic system its own prominent section in the sidebar.

Co-Authored-By: Virgil <virgil@lethean.io>
2026-02-08 20:10:22 +00:00
Snider
a47f038680 feat: add php-commands.yaml spec for new core php commands
Documents 6 new commands for the core CLI:

**New commands:**
- `core php psalm` - Psalm static analysis with --fix, --level
- `core php audit` - composer audit + npm audit
- `core php security` - Security scanning (security-checks.yaml)
- `core php qa` - Full QA pipeline (qa.yaml)
- `core php rector` - Automated refactoring with --fix
- `core php infection` - Mutation testing with --min-msi

**Enhancements to existing:**
- `core php analyse --psalm` - Run both PHPStan and Psalm
- `core php test --mutation` - Run tests then Infection

**Command groups for help:**
- development: dev, logs, stop, status, shell
- quality: test, fmt, analyse, psalm, qa
- security: audit, security
- refactoring: rector, infection
- deployment: build, serve, deploy, etc.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 23:28:48 +00:00
Snider
1c5cbac9f7 feat: add security-checks.yaml spec for core php security command
Defines 45+ security checks implementable in Go without PHP runtime:

**Check categories:**
- Environment (13): APP_DEBUG, APP_KEY, cookies, HTTPS, passwords
- Filesystem (6): .env exposure, permissions, sensitive files
- Config (4): CSRF, throttling, hashing, sessions
- Patterns (9): XSS, SQLi, command injection, hardcoded creds
- Tools (3): composer audit, npm audit, phpstan
- Headers (4): HSTS, CSP, X-Frame-Options (optional)

**Implementation approach:**
- Parse .env directly (no PHP needed)
- Regex patterns on PHP/Blade files
- Shell out to existing tools
- CWE references for each check

For `core php security` command in Go CLI.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 23:25:50 +00:00
Snider
94ce7bc1e7 feat: add QA pipeline with security and mutation testing tools
Add comprehensive PHP quality assurance tooling:

**New tools:**
- roave/security-advisories - Blocks packages with known CVEs
- infection/infection - Mutation testing for test quality
- rector/rector - Automated refactoring and PHP upgrades
- psalm/plugin-laravel - Better Laravel support in Psalm

**New config files:**
- qa.yaml - QA pipeline definition for `core php qa` command
- infection.json5 - Mutation testing configuration
- rector.php - Automated refactoring rules

**QA Pipeline stages:**
1. Quick: security audit, code style, PHPStan
2. Standard: Psalm, tests
3. Full: Rector dry-run, mutation testing

**Current status:**
- Security: No vulnerabilities
- Pint: Pass
- PHPStan: Level 1, 0 errors
- Psalm: Level 8, 0 errors, 93% type inference
- Tests: 197 passing
- Rector: 225 files with potential improvements

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 23:21:12 +00:00
Snider
560c6aec4d fix: add return types to render() methods
Add \Illuminate\Contracts\View\View return type to 23 Livewire
and Blade component render() methods for better static analysis.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 23:12:35 +00:00
Snider
7e367803fc fix: resolve static analysis issues and bump PHPStan to level 1
- Replace \Log:: with proper Log facade imports in Channel.php and EncryptArrayObject.php
- Remove unnecessary null coalescing on $_GET/$_POST superglobals in Input.php
- Add @property annotations to SeoMetadata and ImageOptimization models
- Add @property-read annotations for Livewire computed properties in ConfigPanel and WorkspaceConfig
- Bump PHPStan level from 0 to 1
- Remove Log facade from Psalm suppressions (now properly imported)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 23:09:27 +00:00
Snider
1ab03b7c59 fix: resolve static analysis errors in PHPStan and Psalm
- Configure PHPStan at level 0 with suppressions for optional dependencies
- Configure Psalm at level 8 with issue handlers for:
  - Optional packages (Bunny, FFMpeg, Imagick, Intervention, Predis, Flux, Horizon)
  - Runtime class aliases (App\Support\*, App\Traits\*)
  - Cross-package dependencies (Core\Tenant\*, Core\Config\Workspace)
  - Laravel HasFactory template param and NoValue false positives
- Fix StorageMetrics::increment() accessibility by adding public wrapper
- Add autoload-dev mappings for test fixture namespaces

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 22:58:44 +00:00
Snider
8d2ace98cf fix: resolve all test failures
- Add ActivitylogServiceProvider to activity tests
- Configure spatie activitylog settings in test environment
- Use spatie's withoutLogs() for disabling activity logging
- Check if Livewire is available before registering components
- Add PSR-4 autoload mapping for test fixtures (Core\TestCore, App\Custom)
- Fix ModuleScannerTest to scan correct fixture path (Website not Mod)
- Fix ModuleRegistryTest assertion to check ['method'] key

All 197 tests now pass.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 22:42:19 +00:00
Snider
0eea8b5408 fix: resolve CI test failures
- Add activity log migration for tests
- Fix migration path in ActivityLogServiceTest and LogsActivityTraitTest
- Create tests/Unit directory with .gitkeep
- Fix code style (line endings) via Laravel Pint

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 22:33:41 +00:00
Snider
7696d8cd41 docs(deploy): add PHP deployment guide
- Add PHP deployment with FrankenPHP containers
- Document core php build, serve, and deploy commands
- Include Coolify deployment integration
- Add CI/CD examples for GitHub Actions and GitLab
- Update nav and sidebar with PHP option

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 22:27:50 +00:00
Snider
bdc03c5658 docs: add Deploy section with LinuxKit VMs, templates, and Docker
- Add /deploy/ section with overview, navigation, and sidebar
- LinuxKit VMs: running images, managing VMs, building images
- Templates: pre-configured VM templates (core-dev, server-php, edge-node)
- Docker: compose, multi-stage builds, orchestration guides
- Update nav dropdown with Deploy items

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 22:24:54 +00:00
Snider
f831fd6846 docs: restructure with Build/Publish sections and dynamic nav
- Move PHP and Go framework docs from /packages/ to /build/
- Move CLI docs from /packages/go/cmd/ to /build/cli/
- Add /publish/ section with docs for all release publishers:
  GitHub, Docker, npm, Homebrew, Scoop, AUR, Chocolatey, LinuxKit
- Add sidebar navigation for /publish/ section
- Update nav with Build, Publish, Deploy dropdowns
- Remove changelog, contributing, guide, and security sections
- Make sidebar auto-discover from packages, build, publish, deploy dirs

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 22:20:32 +00:00
Snider
421d4ae0cd docs: add missing package index pages for dynamic nav
- Add index.md for commerce, content, developer, tenant packages
- Update packages/index.md to include all 9 packages in grid
- Fix dead link patterns in config for package root URLs

The sidebar and nav dropdown now auto-discover all packages.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 21:47:35 +00:00
Snider
c1920e541e docs: add examples for Go, PHP, and VM commands 2026-01-29 21:33:10 +00:00
Snider
55d4f0f385 docs(go): add Claude Code skill documentation
Documents the core CLI skill for Claude Code:
- Installation methods (project-based and global)
- Usage patterns (automatic and manual invocation)
- What Claude learns (testing, building, multi-repo)
- Command reference overview
- Customisation options

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 11:23:46 +00:00
Snider
a088415eb0 docs(go): add core test command documentation
Documents the new `core test` command with:
- All flags and options
- Example usage patterns
- Output samples (default, coverage, JSON)
- macOS linker warning suppression feature
- Coverage colour coding explanation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 11:16:51 +00:00
Snider
eee31c1222 chore: remove vitepress cache from tracking
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 10:58:01 +00:00
Snider
632bca9111 feat(docs): restructure with PHP/Go framework sections
- Add auto-discovery sidebar with nested directory support
- Create packages index with search and grid layout
- Move framework docs to packages/php/
- Update nav: Guide | PHP | Go | Packages | Security

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 10:47:50 +00:00
Snider
6b6612af83 docs: rewrite CLAUDE.md with frontages, L1 packages, and actions
Restructure documentation for Claude Code to better reflect codebase:
- Add frontages table explaining context-specific lifecycle events
- Document L1 package structure under src/Core/
- Add actions pattern with usage example
- Fix namespace mapping to match composer.json autoload
- Add single test filtering command

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-28 13:59:41 +00:00
Snider
087d0ad557 refactor: update namespaces for L1 package convention
- Core\Mod\Tenant -> Core\Tenant
- Core\Mod\Agentic -> Core\Agentic

Part of namespace restructure to align with L1/L2 module conventions.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-27 17:34:38 +00:00
Snider
afc03418eb docs: add changelog entries for Jan 2026
- Core package extraction plan (Flux Pro/Free, FontAwesome fallbacks)
- Event-driven module loading task doc (complete)
- In-app browser detection documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-27 16:27:42 +00:00
Snider
94cb8cc3fa feat: add webhook security validation rules
- SafeWebhookUrl: SSRF protection for webhook URLs (blocks private IPs, localhost, reserved ranges)
- SafeJsonPayload: validates JSON payload structure and size

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-27 13:10:11 +00:00
Snider
f3125b8fa0 fix(config): update ignore patterns for dead links and add coverage directory to .gitignore 2026-01-26 21:37:33 +00:00
Snider
3d407ed5d3 fix(authentication): update examples for API keys to improve clarity 2026-01-26 21:23:12 +00:00
Snider
b05e3a0c13 feat(components): add new Blade components for Flux UI including icons, charts, and form elements 2026-01-26 21:21:53 +00:00
Snider
294e73e189 feat(footer): add customizable footer component with dynamic content and links 2026-01-26 20:46:49 +00:00
Snider
b0e3ef461f feat(workspace): implement workspace teams and permissions management with enhanced member model 2026-01-26 19:00:50 +00:00
Snider
537f01672b feat(database): create mcp_tool_versions table and model for versioned tool management 2026-01-26 18:25:23 +00:00
Snider
7631afb12e feat(docs): update TODO list with completed documentation tasks and add new guides for service contracts, seeder system, and SQL security 2026-01-26 18:22:50 +00:00
Snider
62c23b7fe9 feat(webhooks): implement entitlement webhook management with delivery tracking and event handling 2026-01-26 17:52:21 +00:00
Snider
36f524cc5c feat(api): add API versioning support with middleware for version parsing and sunset headers 2026-01-26 16:59:47 +00:00
Snider
f1c4c8f46d feat: add initial framework files including API, console, and web routes; set up testing structure 2026-01-26 14:25:55 +00:00
Snider
e498a1701e refactor: update namespaces and remove deprecated biolinks route; enhance API documentation attributes 2026-01-26 14:24:42 +00:00
Snider
02125e8234 feat(quota): implement workspace quota management with usage tracking and analytics 2026-01-26 14:24:35 +00:00
Snider
cc6cf23ff0 refactor: update references from 'biolink' to 'page' and improve seeder structure 2026-01-26 14:24:25 +00:00
Snider
b8531676e2 feat(search): implement global search component with keyboard navigation and recent searches 2026-01-26 14:24:15 +00:00
Snider
edb34e38d5 fix(privacy): hash IP addresses in referral tracking for GDPR compliance
- ReferralController now stores ip_hash (SHA-256) instead of raw IP in session
- Cookie excludes IP entirely (only stores provider/model/timestamp)
- PlantTreeForAgentReferral uses hashed IPs in tree metadata
- Updated test to verify hashed IP storage

Raw IPs should not be stored in cookies or persisted unnecessarily.
Session-only hashed IP is sufficient for fraud detection.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-26 00:39:07 +00:00
Snider
c8dfc2a8a9 refactor: remove deprecated code for v0.0.1 release
- Remove deprecated device chrome properties and methods from Editor
- Remove deprecated ConfigResolver::bootKeys() and lazy load instead
- Remove deprecated ConfigValue::find() method
- Remove deprecated StorageOffload::getHumanSizeAttribute() accessor
- Clean up API controllers (already using resolveWorkspace trait)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 23:36:01 +00:00
Snider
65dd9af950 refactor: consolidate migrations and clean up core packages
- Remove old incremental migrations (now consolidated into create_* files)
- Clean up cached view files
- Various fixes across core-api, core-mcp, core-php packages

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 22:28:58 +00:00
Snider
1f1c8d0496 fix: add tier columns to users table, remove app-specific seeder
- Add tier and tier_expires_at columns to users table in create migration
- Remove SystemUserSeeder (moved to host.uk.com as it uses app-specific models)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-25 22:20:54 +00:00
Snider
5919bca336 Convert login form to use Flux UI components
Replace raw HTML form elements with Flux UI equivalents:
- flux:heading and flux:subheading for title
- flux:input for email and password fields
- flux:checkbox for remember me
- flux:link for back navigation

Flux UI components integrate properly with Livewire and
handle loading states automatically.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 12:00:30 +00:00
Snider
f6c688d4e1 Fix login button showing all states at once
- Add @fluxAppearance and @fluxScripts to Demo layout
- Replace custom button with flux:button component
- Flux button handles loading states internally

The wire:loading directives weren't working because Livewire's
CSS wasn't being parsed by the browser (style sheet not applied).
Using Flux's button component resolves this cleanly.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 11:55:23 +00:00
Snider
febfeb5fdb Fix AdminMenuProvider interface compatibility
Add HasMenuPermissions trait to classes implementing AdminMenuProvider:
- Website\Hub\Boot
- Core\Mod\Hub\Boot

The trait provides default implementations for the new menuPermissions()
and canViewMenu() methods added to the AdminMenuProvider interface.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-23 11:39:28 +00:00
Snider
2d348f4c2d Update RELEASE-BLOCKERS.md: mark medium issues fixed
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-22 20:03:13 +00:00
Snider
13670ebb34 Add dependency guards and PHPDoc documentation
Dependency guards for optional modules:
- Remove hard use statements for Core\Mod\*, Core\Plug\* classes
- Add class_exists() guards before using optional dependencies
- Change type hints to ?object with docblock annotations
- Add fallback behavior when optional modules not installed

Files with dependency guards added:
- Cdn/Console/CdnPurge.php (Workspace, Purge)
- Cdn/Console/PushAssetsToCdn.php (VBucket)
- Cdn/Boot.php (CdnManager, StorageManager)
- Cdn/Jobs/PushAssetToCdn.php (StorageManager)
- Front/Admin/AdminMenuRegistry.php (User, Workspace, EntitlementService)
- Front/Admin/Contracts/*.php (User, Workspace)
- Front/Admin/View/Components/Sidemenu.php (User, WorkspaceService)
- Front/Mcp/McpContext.php (AgentPlan)

Comprehensive PHPDoc documentation:
- ModuleScanner.php - Scanner mechanics and priority system
- ModuleRegistry.php - Registration flow and querying
- LazyModuleListener.php - Lazy loading mechanism
- LifecycleEventProvider.php - Lifecycle phases
- All Event classes - When fired, context, examples
- Service contracts - HealthCheckable, ServiceDefinition
- Admin contracts - AdminMenuProvider, DynamicMenuProvider

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-22 19:24:39 +00:00
Snider
c6993dbfca Prepare for open-source release
Remove internal branding:
- Replace "Snide" codename with "Core" in documentation
- Remove "host-uk/core" package name check in Boot.php
- Remove company references from CDN service comments
- Remove hardcoded fallback domains

Improve generated code clarity:
- Add [USER] prefix to TODO comments in MakePlugCommand templates
- Add header comments explaining generated files need implementation
- Convert dashboard TODOs to placeholder UI sections
- Remove internal roadmap TODOs from route files

Add EUPL-1.2 license headers:
- Added license header to 231 PHP files
- Skipped 208 Blade templates (HTML, not PHP)

Update release documentation:
- Mark critical and high issues as fixed in RELEASE-BLOCKERS.md

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-22 18:45:52 +00:00
Snider
e5d08be8c7 Update .gitignore to exclude additional vendor and storage directories 2026-01-21 20:22:19 +00:00
Snider
606176585c Fix critical and high severity issues from code review
Security fixes:
- Fix XSS in JSON-LD output via JSON_HEX_TAG (Seo module)
- Fix SQL injection via LIKE wildcards (Config module)
- Fix regex injection in env updates (Console module)
- Fix weak token hashing with HMAC-SHA256 (CDN module)
- Mask database credentials in install output (Console module)

New features:
- Add MakeModCommand, MakePlugCommand, MakeWebsiteCommand scaffolds
- Add event prioritization via array syntax in $listens
- Add EventAuditLog for tracking handler execution and failures
- Add ServiceVersion with semver and deprecation support
- Add HealthCheckable interface with HealthCheckResult
- Add ServiceStatus enum for service health states
- Add DynamicMenuProvider for uncached menu items
- Add LangServiceProvider with auto-discovery and fallback chains

Improvements:
- Add retry logic with exponential backoff (CDN uploads)
- Add file size validation before uploads (100MB default)
- Add key rotation mechanism for LthnHash
- Add Unicode NFC normalization to Sanitiser
- Add configurable filter rules per field (Input)
- Add menu caching with configurable TTL (Admin)
- Add Redis fallback alerting via events (Storage)
- Add Predis support alongside phpredis (Storage)
- Add memory safety checks for image processing (Media)
- Add SchemaValidator for schema.org validation (SEO)
- Add translation key validation in dev environments

Bug fixes:
- Fix nested array filtering returning null (Sanitiser)
- Fix race condition in EmailShieldStat increment
- Fix stack overflow on deep JSON nesting (ConfigResolver)
- Fix missing table existence check (BlocklistService)
- Fix missing class_exists guards (Search, Media)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-21 20:20:14 +00:00
Snider
b26c430cd6 Add core components and initial setup for the PHP framework 2026-01-21 14:11:45 +00:00
Snider
d6fbabf4d9 Add .gitkeep to track empty directories 2026-01-21 14:08:04 +00:00