Heretek-AI/Agent-Builder
1
0 Fork 0
mirror of https://github.com/Heretek-AI/Agent-Builder.git synced 2026-11-07 10:46:08 -10:00
Code Issues Packages Projects Releases Wiki Activity
50 Commits 31 Branches 0 Tags
main
Commit Graph
50 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
BillyOutlast 61221136f5 chore: regenerate README.md and dist/registry.json 2026-10-20 21:23:23 +00:00
John Smith 643b4067c6 V3 2026-10-20 17:23:01 -04:00
BillyOutlast 0135356665 chore: regenerate README.md and dist/registry.json 2026-10-20 19:56:54 +00:00
BillyOutlast b8c3b46d64 Merge pull request #8 from Heretek-AI/feat/agent-builder-v2 
feat v2 overhaul
 2026-10-20 15:56:40 -04:00
John Smith a84b61aa5c test copilot tools content 2026-10-20 15:53:43 -04:00
John Smith 08ea06d59e fix gemini empty tools download 2026-10-20 15:48:44 -04:00
John Smith ad63d4da9a fix copilot tools scoping 2026-10-20 15:42:41 -04:00
John Smith cb0f843958 docs verify pipe fix 2026-10-20 15:32:17 -04:00
John Smith 14f5893c5d fix hidden pi import deny 2026-10-20 15:28:03 -04:00
Agent Builder a0ea0e7620 fix review findings 2026-10-20 15:18:51 -04:00
John Smith 03118cbde7 feat v2 overhaul 2026-10-20 14:28:37 -04:00
BillyOutlast fdc1ae43d3 chore: regenerate README.md and dist/registry.json 2026-10-20 14:17:14 +00:00
John Smith 7884b405aa fix(ci): port sister validate-pr + GENERATED guard + scout-accept persist 
Remove persist-credentials:false from scout-accept (use persisted token).
Validate: test->check-pr(ALLOW_GENERATED)->generate to TEMP, no site before test.
check-pr blocks README/dist edits unless bot. Test drops site==dist coupling.
 2026-10-20 10:16:53 -04:00
BillyOutlast 4ab9038ada chore: regenerate README.md and dist/registry.json 2026-10-20 14:06:28 +00:00
agent-builder-scout c48e620abc docs: add pi-weave to plugins/opencode 2026-10-20 13:52:25 +00:00
BillyOutlast 956c5a540f chore: regenerate README.md and dist/registry.json 2026-10-20 13:51:39 +00:00
John Smith 23d8f24383 fix(scout): use basic x-access-token auth for push + allow retry of failed candidates 
Bearer extraheader is invalid for git smart-HTTP and fails with
'could not read Username'. Match actions/checkout basic auth.
Narrow skip guard from / → / to / → #digits/ and strip prior
failure notes so ticked boxes retry cleanly. Redact token+base64.
 2026-10-20 09:51:03 -04:00
BillyOutlast 29897bb7c2 chore: regenerate README.md and dist/registry.json 2026-10-19 23:41:00 +00:00
BillyOutlast d486bda9fa Merge pull request #5 from Heretek-AI/fix/scout-multi-harness-live-accept 
fix(scout): live multi-harness discovery + tick-to-PR accept
 2026-10-19 19:40:46 -04:00
agency-coordinator 581c5c20b2 fix(scout): close CodeQL fs race — atomic wx create + EEXIST guard 
Closes code-scanning alert 13 (js/file-system-race scripts/scout.js:928).
Replace existsSync-then-write with O_EXCL wx flag, preserve
refusing-to-overwrite error. Harden rollback unlink to ignore ENOENT only.
 2026-10-19 19:37:37 -04:00
agency-coordinator 4b0facdb7b fix(scout): address PR5 review — concurrency scope, credential hardening, license fail-closed, CRLF + idempotency 2026-10-19 16:49:05 -04:00
John Smith 89837d64c4 fix(scout): live multi-harness discovery + tick-to-PR accept 
- scout.yml: live node scripts/scout.js run --limit 30 with GITHUB_TOKEN,
  issues:write + pull-requests:read, timeout 45, persist-credentials false
  (was dry-run mocks, never opened issues)
- scout.js: full npm/GitHub discovery for 8 harnesses + 6 topic families
  (33 SEARCHES, classifyManifest, gating, dedupe, ranking, scout-data issue,
  accept --sender, ACCEPT_LIMIT 10); dry-run stays offline, live fails closed
  without token
- issues.yml: add scout-accept job (edited+scout, write perms, fetch-depth 0,
  accept --issue/--sender); add edited/reopened/labeled types + concurrency

Tests: npm test 124/124, validate 63 OK
Triad: QA_PASS (4+4 sabotage RED->GREEN), DriftGuard VERDICT: PASS x2
 2026-10-19 16:24:37 -04:00
BillyOutlast 7d9d1515c9 ci: add reusable OpenCodeReview PR workflow 2026-10-19 15:49:16 -04:00
BillyOutlast f9a4be3457 Merge pull request #4 from Heretek-AI/fix/modal-a11y 
Fix publish modal dismiss + a11y quick wins
 2026-10-19 14:53:37 -04:00
John Smith c4a547712d fix(site): dismissable publish modal + a11y quick wins 
- styles: .modal-backdrop[hidden]{display:none} (flex was defeating hidden)
- a11y: card/scope h4->h3, dropzone aria-labelledby, fileInput label+24px,
  category li wrappers, .cards min-height (CLS reserve)
- tests: AB-fix regression block in stage4.test.js (7 tests)

VALIDATED 63 ENTRIES OK; npm test 131 pass
 2026-10-19 14:50:53 -04:00
BillyOutlast e97069a528 chore: regenerate README.md and dist/registry.json 2026-10-19 17:38:46 +00:00
BillyOutlast d7741eb6c8 Merge pull request #3 from Heretek-AI/feat/agent-builder-foundation 
Feat/agent builder foundation
 2026-10-19 13:38:32 -04:00
John Smith 8742f3ed36 fix(pr3-gates): clear CodeQL race + Sonar residuals — single-read static, inline ref guards, dropped PATH 
- local-server serveStatic: remove fs.stat check-then-use (TOCTOU); single
  fs.readFile per branch, ENOENT->404 preserved, 403/HEAD/token intact
- check-pr: inline git-ref guards before each sink + assertSafeGitRef kept;
  inherited PATH dropped (literal safe PATH only); NOSONAR backstops w/ reason
- tests: 404/403/HEAD/meta + guard/PATH tripwires (124 pass)

VALIDATED 63 ENTRIES OK; SELFTEST_OK 124 pass
 2026-10-19 13:35:30 -04:00
John Smith 943ed0626a fix(sonar-pr3): clear Security Rating gate — S8705/S4036/S8348 
- check-pr.js: assertSafeGitRef fail-closed (reject leading -, .., whitespace/metachars) on both diff paths; argv arrays kept; explicit safe PATH env
- local-server.js: setCors URL-parse + exact-match + loopback-only echo, NOSONAR justified, no wildcard
- tests: evil-base matrix + CORS evil/lookalike/scheme/junk guards (118 pass)

VALIDATED 63 ENTRIES OK; SELFTEST_OK 118 pass
 2026-10-19 13:26:51 -04:00
John Smith 940e60c600 fix(pr3-review): address CodeRabbit inline findings — fetch-depth, permission probe, credentialed-HTTP, deleted-YAML, SSRF, allowlist, bootToken 
- ai-review.yml: fetch-depth 1->0 for origin/main...HEAD collect
- reports: valid evaluateV2Permission probe with resource/effect -> deny
- local-server: reject apiKey over non-loopback HTTP; SSRF localhost/.localhost, ::ffff: mapped + fail-closed, 100.64/10, fec0, dns.lookup vetted address; exact bare-name allowlist + eval/loader blocks; bootToken meta injection
- check-pr.js: exclude deleted YAML via diff-filter + existsSync
- site/app.js: send x-ab-token/?token= for /api/llm/chat + /api/mcp/call
- tests: localhost + [::ffff:127.0.0.1], allowlist, apiKey guards (39 tests)

VALIDATED 63 ENTRIES OK; REVIEW_OK 63; SELFTEST_OK 112 pass
 2026-10-19 12:54:23 -04:00
BillyOutlast a5eca53d3e Merge branch 'main' into feat/agent-builder-foundation 2026-10-19 11:56:43 -04:00
BillyOutlast 51ca98abf2 Merge pull request #2 from Heretek-AI/fix/fleet-audit-remediation 
fix: fleet audit remediation — fail-closed RCE/SSRF/traversal, catalog re-grounding, CI hardening
 2026-10-19 11:54:57 -04:00
John Smith 5321a4cea2 fix: fleet audit remediation — RCE/SSRF/traversal fail-closed, catalog re-grounding, CI hardening 
- Stage1 P0 security: allowlist introspect (npx,node,python3), argv-only, drop CORS *, per-boot token, SSRF private-range+userinfo block, targetDir absolute/.. block, content_file pattern+containment, test/local-server.test.js 29 tests
- Stage2 P0 catalog: synthetic:true for 14 placeholder entries, real repos/tools for k8s/notion/filesystem/figma/postgres, Codex command/args/env, hyphen-preserving normalize, README npx fix, sst->anomalyco
- Stage3 P1 hardening: dup-id negative tests, check-pr scripts/** fail-closed+wired, ai-review invented-tool/harness/kind/deny-first enforcement, reviewer bare allows, _site clean, engines >=22.12.0, workflows SHA-pinned fetch-depth:1 minimal scopes, CODEOWNERS, ajv->devDeps
- Stage4 P2/P3 polish: install --recipe base64url, SOURCE_DATE_EPOCH idempotency, ? single-char, favicon data-URI, empty warn deny-only, prose fixes, stage4 12 tests

Gates: VALIDATED 63 OK, SITE_BUILT 63, tests 102/102, ai-review REVIEW_OK/SELFTEST_OK
Note: scripts/generate-rigs.py + verify-rigs.sh do not exist; real equivalents used (documented in REMEDIATION_LOG.md)
 2026-10-19 11:53:15 -04:00
BillyOutlast a29af0e69b chore: regenerate README.md and dist/registry.json 2026-10-19 07:46:38 +00:00
BillyOutlast 4a8f7ff3fc Merge pull request #1 from Heretek-AI/feat/agent-builder-foundation 
feat: Agent Builder foundation (M1-M12, 63-entry registry, WebUI, CLI, MCP)
 2026-10-19 03:46:25 -04:00
John Smith d0a17eecf4 fix(ci): build site before tests to unblock Validate PR and AI Review 
- validate-pr.yml: run npm run site before npm test (_site/ is gitignored but required by test/catalog.test.js:171)
- ai-review.js selftest: run build-site.js between validate and run-tests (fail-closed)

QA: 43/43 pass, selftest SELFTEST_OK. Drift Guard VERDICT: PASS
 2026-10-19 03:40:21 -04:00
John Smith 85619fb9a1 chore: refresh registry timestamp after final verification 2026-10-19 02:10:37 -04:00
John Smith 49cc4ac8bb feat(m12): full test suite, contributing guide, license and final verification 2026-10-19 02:10:28 -04:00
John Smith ae3f1da12d feat(m11): GitHub Actions workflows for validate, pages and automation 2026-10-19 02:07:49 -04:00
John Smith 8cdf66b919 feat(m10): issue forms and maintainer automation scripts 2026-10-19 02:05:46 -04:00
John Smith d56e6a15f5 feat(m9): MCP server with stdio JSON-RPC and tests 2026-10-19 02:02:49 -04:00
John Smith 3fa7edcbe4 feat(m8): local CLI and bridge server with serve compile install 2026-10-19 02:00:48 -04:00
John Smith 57fa85ae42 feat(m7): interactive agent builder WebUI and site builder 2026-10-19 01:57:25 -04:00
John Smith 4053a0888d feat(m6): upstream seed importers with 63 curated entries and attribution 2026-10-19 01:54:52 -04:00
John Smith 13185cf4f2 feat(m5): multi-harness config compiler, importer and tests 2026-10-19 01:51:49 -04:00
John Smith 22eb1dbd56 feat(m4): hierarchical README generator, YAML formatter and entry scaffolder 2026-10-19 01:48:31 -04:00
John Smith 4be1493777 feat(m3): registry compiler and content bundler 2026-10-19 01:46:42 -04:00
John Smith fd19d7c474 feat(m2): taxonomy, schema and validator with 15 seed entries 2026-10-19 01:45:20 -04:00
John Smith f362418c7c feat(m1): repository initialization, toolchain setup and verification spike 2026-10-19 01:43:26 -04:00
BillyOutlast 9b58157079 Initial commit 2026-10-18 21:42:17 -04:00