mirror of
https://github.com/codewhale-hq/Codewhale.git
synced 2026-11-07 02:26:02 -10:00
CodeWhale BotandClaude Opus 5.5
cf10ca1446
Pre-launch security review 2026-10-27 (two of its findings, plus hygiene): - mcp: a server-supplied list ttlMs had no floor, so ttlMs 0 made the catalog stale on every 5s tick, and revalidation runs discovery while holding the MCP pool lock. Any configured server could keep every MCP operation waiting. Catalog TTLs are now clamped to at least 60s. Still open: running discovery outside the lock, and rate-limiting list_changed-driven revalidation. - runtime_api/git: validated_patch sliced the first byte off each @@ range token, which panicked on a multi-byte character and fired the process panic hook. It now strips the expected -/+ sign and refuses anything else as a malformed @@ line. - .gitignore: ignore private key and certificate files, with an exception for the existing test-only fixture key. Verified: scripts/dev-test.sh runtime_api/git.rs git_ -> 146 tests run: 146 passed (includes git_routes_drive_a_real_workspace_repo and git_write_preconditions_reject_stale_state); scripts/dev-test.sh mcp.rs mcp:: -> 405 tests run: 405 passed. No new tests, per repo policy. Co-Authored-By: Claude Opus 5.5 <[email protected]>
193 lines
4.0 KiB
Plaintext
193 lines
4.0 KiB
Plaintext
# Build artifacts
|
|
/target
|
|
/target-*
|
|
/vendor/codewhale-ratatui/target/
|
|
.entire/
|
|
.cursor/
|
|
.plans/
|
|
.codewhale-worktrees/
|
|
docs/superpowers/
|
|
codewhale-inference/
|
|
/extensions/vscode/out/
|
|
*.pdb
|
|
*.exe
|
|
*.dll
|
|
*.so
|
|
*.dylib
|
|
*.rlib
|
|
*.o
|
|
|
|
# Development
|
|
.env
|
|
.env.*
|
|
!.env.example
|
|
node_modules/
|
|
.vscode/
|
|
# The extension ships its own dev-loop config (F5 Extension Development Host).
|
|
# Without this negation the bare `.vscode/` above swallows it silently.
|
|
!/extensions/vscode/.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.py[cod]
|
|
*$py.class
|
|
.pytest_cache/
|
|
venv/
|
|
ENV/
|
|
env/
|
|
.venv/
|
|
*.egg-info/
|
|
dist/
|
|
|
|
# Logs
|
|
*.log
|
|
|
|
# Generated
|
|
# Local design critiques and operator receipts do not ship with the product.
|
|
/.impeccable/
|
|
outputs/
|
|
tmp/
|
|
backup/
|
|
|
|
# Reference papers / large research blobs (keep locally if needed, don't ship)
|
|
docs/DeepSeek_V4.pdf
|
|
docs/*.pdf
|
|
|
|
# Note: Cargo.lock is intentionally NOT ignored for reproducible builds
|
|
|
|
# Local dev scripts and temp files
|
|
*.sh
|
|
*.cmd
|
|
!scripts/**
|
|
!.github/scripts/**
|
|
!web/public/install.sh
|
|
!packaging/winget/**
|
|
# Bridge launchers are shipped entry points (`npm run bridge`), not local dev
|
|
# scripts; `!scripts/**` above only re-includes the repo-root scripts/ dir.
|
|
!integrations/*/scripts/**
|
|
test.txt
|
|
TODO*.md
|
|
todo*.md
|
|
AGENTS.md
|
|
# …except the deliberate, maintained agent-guidance files:
|
|
!/AGENTS.md
|
|
!crates/tui/AGENTS.md
|
|
!crates/tui/locales/AGENTS.md
|
|
!web/AGENTS.md
|
|
NEXT_SESSION.md
|
|
AI_HANDOFF.md
|
|
result.json
|
|
count_deps.py
|
|
project_overhaul_prompt.md
|
|
.codex/
|
|
.context/
|
|
.wrangler/
|
|
|
|
# Local runtime state
|
|
# Ignore everything under any .codewhale/ (snapshots, auto-generated
|
|
# instructions.md, etc.) at any depth EXCEPT the committed repo authority policy.
|
|
**/.codewhale/*
|
|
!**/.codewhale/constitution.json
|
|
.deepseek/
|
|
**/session_*.json
|
|
*.db
|
|
|
|
# Chat bridge local state. `npm run bridge` writes the Weixin bot login token
|
|
# (account.json) and the long-poll cursor here; these are live credentials.
|
|
integrations/*-bridge/.state/
|
|
npm/*/bin/downloads/
|
|
|
|
# Companion app (tracked separately)
|
|
apps/
|
|
|
|
# Claude Code runtime artifacts
|
|
.worktrees/
|
|
.ace-tool/
|
|
|
|
# NOTE: the blanket `.claude/` rule further down already ignores everything
|
|
# under .claude/ — `git check-ignore -v` attributes every path below to that
|
|
# line, not to these. The handoff/codemap patterns are kept as defense in depth:
|
|
# those notes are working state, not user-facing artifacts, and they leaked into
|
|
# the public repo through .claude/ before (HANDOFF_v0.8.28, CODEMAP_v0.8.25).
|
|
# They live under .private/handoffs/ now. If anyone ever narrows the blanket
|
|
# rule to track part of .claude/, these must keep holding.
|
|
.claude/HANDOFF_*
|
|
.claude/CODEMAP_*
|
|
.claude/handoff_*
|
|
.claude/codemap_*
|
|
|
|
# Maintainer-internal design notes (trade-secret material, never published)
|
|
.private/
|
|
|
|
# Coverage reports (build artifacts)
|
|
web/coverage/
|
|
|
|
# Agent handoffs and version-specific setup plans are working-state notes, not
|
|
# public docs. Keep durable setup guidance in docs/runbooks instead.
|
|
docs/*HANDOFF*.md
|
|
docs/*handoff*.md
|
|
docs/*_PLAN.md
|
|
!docs/archive/**
|
|
|
|
# direnv
|
|
.envrc
|
|
.direnv
|
|
scripts/run_deep_swe.py
|
|
.claude/
|
|
|
|
# Local run artifacts and caches re-included by !scripts/**
|
|
results/
|
|
scripts/**/__pycache__/
|
|
|
|
# Maintainer-local verification artifacts
|
|
.uv-bin/
|
|
.uv-cache/
|
|
.uv-tools/
|
|
issues/
|
|
logs/
|
|
notes/
|
|
|
|
# Agent-local roadmap and scratch (never commit — may hold unreleased plans)
|
|
.agents/
|
|
scratchpad/
|
|
|
|
# Exploratory operations spec / prompt — never track (canonical copy lives at CW root)
|
|
operations9.md
|
|
OPERATIONS_0_9_0.md
|
|
operations_0_9_0.md
|
|
CODEWHALE_0_9_0_CUTOVER.md
|
|
|
|
# Hepha project metadata (local only, not upstream)
|
|
.hepha/
|
|
|
|
# Ralph agent scratch (local only)
|
|
.ralph/
|
|
|
|
# Local playwright MCP artifacts
|
|
.playwright-mcp/
|
|
|
|
# computer-use plugin smoke receipts (per-run local evidence)
|
|
crates/tui/plugins/computer-use/receipts/
|
|
|
|
# OrcaRouter provider screenshot evidence (per-run local evidence)
|
|
orca-evidence/
|
|
|
|
# Portable pet build entry points are source.
|
|
!pet/**/*.sh
|
|
!pet/verify.sh
|
|
|
|
# Private keys and certificates never belong in the tree.
|
|
*.pem
|
|
*.key
|
|
*.p12
|
|
*.p8
|
|
id_rsa*
|
|
id_ed25519*
|
|
!docs/cloud-facts/fixtures/test-only-signing-key.pem
|