Ship first-party dashboard with container#64
Closed
AnExiledDev wants to merge 33 commits intomainfrom
Closed
Conversation
Security guards, workspace scope enforcement, readonly bash guard, and agent redirect logic had zero test coverage. This adds pytest tests for the pure functions in each script, covering all regex patterns, edge cases, bypass vectors, and false positive checks.
- Resolve CHANGELOG.md merge conflict (testing section + main's fixes) - Fix run_main() return type in test_redirect_builtin_agents.py (CodeRabbit review) - Update block-dangerous tests for new source patterns: - --force-with-lease now intentionally blocked (was documented as bug) - Bare force push message changed to FORCE_PUSH_SUGGESTION - Add tests for remote branch deletion patterns (--delete, colon-refspec)
Scope guard: resolve CWD with realpath to prevent symlink mismatches, detect .claude/worktrees/ and expand scope to project root so sibling worktrees aren't blocked, and improve error messages with resolved paths. Stop hooks: add 5-minute per-session cooldown to commit-reminder and spec-reminder to prevent repeated firing in team/agent scenarios.
resolve_scope_root() now walks up from CWD looking for .git to find the repository root, preventing false positives when working in subdirectories like cli/, src/, or tests/. Safety ceiling at /workspaces prevents scope from escaping the workspace boundary.
Move .git/ to project root so the entire workspace is tracked in a single repository. Git detects all container-root files as renames into the container/ subdirectory. Root-level files (.github/, LICENSE.txt, CLA.md, CONTRIBUTING.md, .gitattributes) remain at the repository root. The docs/ package was already tracked at docs/ and is unaffected by this change. This is a structural reorganization — no code changes.
Add codeforge-cli v0.1.0 (Bun/TypeScript) — a CLI for CodeForge development workflows including session search, plan management, and task tracking. The docs package was already tracked from the previous repository structure.
CI workflows: - Add working-directory: container to all container job steps - Add path filters (container/**, cli/**) to trigger workflows selectively - Add test-cli job using Bun for CLI package - Update changelog/package.json paths for container subdirectory - Update devcontainer feature publish paths Config: - Add repository.directory to container and cli package.json - Remove docs:* scripts from container (docs is now a sibling package) - Simplify container/.gitignore (root handles shared patterns) - Update dependabot directories for monorepo layout Docs: - Add root README.md with monorepo overview and package table - Add root CLAUDE.md with branching strategy and dev rules - Update container/CLAUDE.md to reference root for shared rules
Update sync-changelog.mjs to read from container/.devcontainer/CHANGELOG.md instead of the old .devcontainer/CHANGELOG.md path. Regenerate the docs changelog page with updated source reference.
Scope guard now only enforces isolation between workspace projects. Paths outside the workspace (e.g. /dev/null, /usr/, /etc/) are not this guard's jurisdiction — other guards handle system-level security. Removes the complex system-command exemption logic that was insufficient and fragile.
The redirect patterns matched text content inside command arguments (e.g. PR body text containing example paths), causing false positives. Write location enforcement is the scope guard's responsibility, not the dangerous-command-blocker's.
- plugin list/show/enable/disable/hooks/agents/skills subcommands - config show/apply subcommands with settings writer - review command with headless Claude runner and prompt templates - Plugin/config/review schemas, loaders, and output formatters - Platform detection utility - Tests for plugin loader, plugin list, review output, review runner, settings writer, and platform detection
- Register plugin, config, and review subcommands in index.ts - Remove fast-glob dependency (use native Bun glob) - Fix build output to single file (--outfile dist/codeforge.js) - Add npm publish metadata (keywords, files, prepublishOnly) - Fix search filter edge cases with new tests - Fix plan-loader path resolution - Update session list/show formatting
- release-cli.yml: tag-triggered (cli-v*) npm publish + GitHub release - codeforge-cli devcontainer feature: installs CLI globally via npm - Register codeforge-cli feature in devcontainer.json - Remove dead codeforge alias, add codeforge to cc-tools list - CI: cross-platform test matrix (ubuntu, windows, macos) - Fix docs changelog sync paths for monorepo structure
Add plugin, config, and review commands to CLI
…weep CLI (experimental): - Add index command group (build, search, show, stats, tree, clean) - Add container command group (up, down, rebuild, exec, ls, shell) - Add container proxy — auto-proxies into devcontainer from host - Remove review command (never shipped) - Mark CLI as experimental in all metadata and docs Container (v2.1.0 + v2.1.1): - Spec workflow v2 "Spec Packages" — 8 commands replaced with 3 - Scope guard: fix /dev/null false positive, fix CWD drift - Updated agents, skills, system prompts, and config Docs: - Add CLI commands to reference, tools, and changelog pages - Sync docs changelog with container CHANGELOG (v2.1.0, v2.1.1) - Update spec workflow, agents, skills, and rules docs
…weep (#58) CLI (experimental): - Add index command group (build, search, show, stats, tree, clean) - Add container command group (up, down, rebuild, exec, ls, shell) - Add container proxy — auto-proxies into devcontainer from host - Remove review command (never shipped) - Mark CLI as experimental in all metadata and docs Container (v2.1.0 + v2.1.1): - Spec workflow v2 "Spec Packages" — 8 commands replaced with 3 - Scope guard: fix /dev/null false positive, fix CWD drift - Updated agents, skills, system prompts, and config Docs: - Add CLI commands to reference, tools, and changelog pages - Sync docs changelog with container CHANGELOG (v2.1.0, v2.1.1) - Update spec workflow, agents, skills, and rules docs Co-authored-by: AnExiledDev <[email protected]>
- CLI CHANGELOG: "Ships with CodeForge v2.1.0" → "v2.1.1" to match the actual container release version - Remove agent-system's inject-cwd.py and its SubagentStart hook — workspace-scope-guard already handles SubagentStart with superior scope-resolved CWD (worktree-aware, git-root-aware, session-persisted)
# Conflicts: # container/.devcontainer/CHANGELOG.md # container/package.json
Installer now falls back to HOME override when su is unavailable, which happens on VM-based Docker (Docker Desktop). Also removes unnecessary su call in version verification.
…iner runtime - Switch status bar from 6-line ccburn layout to 3-line native session-usage and weekly-usage ccstatusline widgets - Disable ccburn devcontainer feature (commented out in devcontainer.json) - Remove preflight.sh — redundant with Docker's own error reporting - Forward port 7847 for dashboard and add container name to runArgs
- Add autoMemoryDirectory setting for project-local .claude/memory/ - Add safety rules, hooks awareness, tool selection guidance, and anti-over-engineering directives to main and orchestrator prompts - Add auto-memory system documentation with memory types and format - Add context management notes for tool result persistence
New skill for headless browser automation with CLI reference and workflow patterns. Bumps skill count from 22 to 23 across plugin metadata, container docs, and site documentation. Also adds CLAUDE_PLUGIN_DATA docs, npmignore hardening, and changelog entries.
New commands for viewing team tasks: `codeforge task list` shows all tasks for a team, `codeforge task show` displays task detail with dependencies. Includes text and JSON formatters and test coverage. Also removes prompts/ from package files and adds CLI README.
Session list now shows plan slugs and task progress bars when sessions have associated plans or team tasks. Loads plans once and indexes by slug, caches task summaries per team name. Includes text and JSON output support with full test coverage.
New Svelte 5 SPA + Bun backend for session analytics, conversation replay, task/plan/agent views, and cost tracking. Updates root CLAUDE.md to reflect four-package monorepo with dashboard-specific test commands and Dashboard vs CLI guidance.
Spec packages are local working directories, not tracked in version control.
Dashboard package: - Rename @codeforge/dashboard → codeforge-dashboard, remove private flag - Add bin wrapper with --port/--host/--version/--help flags - Add HOST env var support to Bun.serve for container port forwarding - Add files, engines, prepublishOnly fields for npm publish - Move build-time deps (Svelte, Vite, Tailwind) to devDependencies Container feature: - Rewrite install.sh: bun install -g replaces npm install -g - Add autostart poststart hook (PID-guarded, nohup background launch) - Rename command: claude-dashboard → codeforge-dashboard - Remove persistence symlink hook (DB on bind mount) - Update feature metadata, README, devcontainer.json, CLAUDE.md CI/CD: - Add release-dashboard.yml workflow (dashboard-v* tags → npm publish) - Add test-dashboard job to ci.yml - Add dashboard/CHANGELOG.md
|
Important Review skippedToo many files! This PR contains 299 files, which is 149 over the limit of 150. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (299)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can scan for known vulnerabilities in your dependencies using OSV Scanner.OSV Scanner will automatically detect and report security vulnerabilities in your project's dependencies. No additional configuration is required. |
- Add dashboard/.svelte-kit/, dashboard/build/, dashboard/mockups/, and .claude/ to .gitignore - Untrack 817 committed build artifacts (git rm --cached) - Replace git-changes statusline widget with cached custom-command that skips git diff when index.lock is held and caches results for 30s - Add allow-list exception to protected-files-guard for .git/index.lock deletion
Container: - Update devcontainer.json configuration - Expand claude-code-headless skill documentation Dashboard — Parser/Server: - Add memory-sync service for background synchronization - Update parser queries, types, and DB layer for memory filtering - Extend API routes with memory and session endpoints Dashboard — UI Components: - Add ApproveModal, MaintenanceModal, and ConfirmModal components - Enhance memory views: MemoriesPage, MemoriesTab, ObservationsTab, RunDetail, RunsTab with filtering and approval workflows - Update session views: SessionList, SessionDetail, AgentsView - Improve dashboard charts: ActivityHeatmap, DurationDistribution, HourlyHeatmap, ModelDistribution, OverviewCards, ToolUsage - Update Sidebar, ProjectDetail, and global styles Dashboard — Stores/Routes: - Extend memory, sessions, and SSE stores for new data flows - Update page routes for memories and session detail views
# Conflicts: # container/.devcontainer/CHANGELOG.md # container/package.json
# Conflicts: # .gitignore # cli/CHANGELOG.md # cli/src/index.ts # container/.codeforge/config/orchestrator-system-prompt.md # container/.devcontainer/CHANGELOG.md # container/.devcontainer/CLAUDE.md
… into staging # Conflicts: # container/.devcontainer/CHANGELOG.md # container/.devcontainer/plugins/devs-marketplace/plugins/workspace-scope-guard/scripts/guard-workspace-scope.py
Owner
Author
|
Merged to staging directly |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
codeforge-dashboardon npm — Svelte 5 SPA + Bun backend with bin wrapper, HOST binding, and devDependencies-only install footprintbun install -ginstead of npm, auto-launches on container start via PID-guarded poststart hook, command renamed fromclaude-dashboard→codeforge-dashboardrelease-dashboard.ymlworkflow (triggered bydashboard-v*tags), dashboard tests added toci.ymlscripts/to files field, arg guards in bin script,node→bunfor --version, build-time deps moved to devDependencies, stale references cleaned upChanged files
Dashboard package (
dashboard/)package.json— rename, unprivate, add bin/files/engines/prepublishOnly, restructure depsbin/codeforge-dashboard— new bash wrapper with flag parsing and arg guardssrc/server/index.ts— HOST env var →Bun.serve({ hostname })CHANGELOG.md— new, v0.1.0 entrybun.lock— updated from dep restructureContainer (
.devcontainer/)features/claude-session-dashboard/install.sh— full rewrite for bun + autostartfeatures/claude-session-dashboard/devcontainer-feature.json— add autostart option, update metadatafeatures/claude-session-dashboard/README.md— full rewrite for first-party packagedevcontainer.json— port label update, fix stale install-order commentCHANGELOG.md— dashboard section under UnreleasedCLAUDE.md— command reference updatedREADME.md— command table updatedCI/CD (
.github/workflows/)release-dashboard.yml— new publish workflowci.yml— add test-dashboard job and dashboard path triggerTest plan
bun test)npm pack --dry-runconfirms correct files (includingscripts/query-db.ts)--versionworks (uses bun),--portwithout value shows clean errorbash -n install.sh— syntax validclaude-dashboardreferences (grep verified, excluding intentional CHANGELOG/migration entries)test-dashboardjob passes on GitHub Actions