Skip to content

fix: update compatible vulnerable dependencies - #760

Closed
jdell64 wants to merge 93 commits into
HarnessMD:mainfrom
jdell64:fix/npm-audit-2026-10
Closed

jdell64 wants to merge 93 commits into
HarnessMD:mainfrom
jdell64:fix/npm-audit-2026-10

Conversation

@jdell64

@jdell64 jdell64 commented Oct 18, 2026

Copy link
Copy Markdown

Updates compatible dependency resolutions in package-lock.json based on the npm audit report. Includes MCP SDK 1.32.1 and fast-uri 3.1.8. Remaining findings require major upgrades or have no available fix. The npm-audit report is not included.

jdell64 and others added 30 commits October 12, 2026 14:40
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X33p8Vn3btauq4qFjAnJ6P
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…re-reap)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X33p8Vn3btauq4qFjAnJ6P
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X33p8Vn3btauq4qFjAnJ6P
jdell64 and others added 25 commits October 17, 2026 12:37
Consolidate the contribution and security policies with the approved user-facing Agent Stage branding sweep. Preserve functional identifiers and legacy compatibility paths for a separately managed migration.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_018ZNqzQNbSAVRTG7r78GLdY
Retain the original MIT copyright notice and add Richard J Tindell II as a second 2026 copyright holder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_018ZNqzQNbSAVRTG7r78GLdY
…newest transcript file

Ported from guppyos f8f706a (Condensation: one owned print-mode process
instead of the newest file in a shared directory).

runHiddenClaude() now spawns `claude --print` with a per-attempt --session-id,
prompt on stdin, bounded stdout/stderr, resolves on 'close', and strips
ANTHROPIC_API_KEY/AUTH_TOKEN/KEY_HELPER from the child env. The PTY and the
'newest .jsonl in a shared dir' capture are gone, so one agent's summary can no
longer be written into another's memory.md.

Port adaptations: this fork's marker-framed summary protocol and parseSummary
are kept (no --json-schema / validateSummary); reflect.ts reads result.result.
MemoryReflector gains an injectable runHidden (tests only). The guppyos
reflect-condense test is rewritten for the marker protocol; automatic-submit-wiring
is not present in this fork and is not ported.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…at 8 MB

Ported from guppyos b8017b6 (LOG-STALL-AV) + 672311a (PERF-153-FINAL), with the
appendLog.ts rotation hardening from 9be847c.

Every log/ledger row was an appendFileSync (open+append+close), which an antivirus
rescans each time, so cost grew with file size. New src/main/appendLog.ts writes
through a kept-open descriptor, rotates at 8 MB (log keeps 8, ledger keeps all, a
pre-existing oversize file is kept as log.legacy-<stamp>.jsonl, never deleted), and
notices a file deleted underneath it (fstat nlink, at most 1/s). logTail and the
lifetime-cost fold read across rotated files; logTail also gets the bounded
tail read.

Port adaptations: keep-open stays OPT-IN (HiveManager.keepAppendFilesOpen(true) in
index.ts) so tests that delete a hive folder are not blocked by a held file; it is
closed before app:resetAll's rm, config:changeHome's copy, and at quit. NOT ported:
wakeRowPolicy / wake-folded rows (this fork has no event-path wake rows) and the
unrelated 9be847c hardenings (AGY idle, PRIOR_TEXT_UNVERIFIED).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…spawn

Ported from guppyos 3b96752 (merge model-persist-148: per-agent model persistence).

The Claude status line reports the live model; HookServer records it per agent
(HiveManager.recordModel -> registry.json `model`), and only when it differs from the
app default, so Settings changes still reach agents that never picked their own.
A respawn passes it as --model via the new modelForHiveSpawn (a saved per-agent choice
beats defaultModel / the orchestrator model; an explicit argv --model still wins).
Claude agents only: a bridged provider's display model is never turned into argv.

Port adaptations: god -> orchestrator names (isOrchestrator, orchestratorProvider/Model).
NOT included (later guppyos refinements, left for a follow-up): cea47f1/fa74b3d6
MODEL-PINBACK (user vs auto pins, Codex config), a9f9f36 (effort survives restarts,
EditAgentModal/AgentDetailPanel UI).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add optional, validated tile-space cameraBounds. TNG uses it to frame its bridge action area while themes without it retain full-map framing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_018ZNqzQNbSAVRTG7r78GLdY
…ilds/full test runs run at once

Ported from guppyos 3a82123 (HEAVY-JOB-SERIALIZE).

A table-driven classifier recognises heavy commands (installs, builds, full/glob/
many-file suites, bench/replay/mutation scripts; one level of bash -c / cmd /c
unwrapped; light work such as a single test file is never gated). A counting
semaphore grants N slots (Settings -> Autonomy & Budgets 'Heavy jobs at once':
Off or 1-8, default 1, read live). PreToolUse takes a slot, re-enters the agent's
own, or DENIES naming every holder; a foreground call's PostToolUse frees it; a
background job is freed by a process check that runs only while held, by PTY exit,
or by a 60 min TTL. Rows are logged and fleet.json carries heavyLock {limit, holders}.

Port adaptations: hunks re-applied by hand against this fork's index.ts/config.ts
(usageEndpoint kept); god -> orchestrator wording in the deny reason; test uses
closeAppendFiles() (not guppyos hive.dispose) and tolerates the Windows temp-dir
EBUSY. test/wake-telemetry.test.cjs edit not ported (file absent here). Later
guppyos heavy-lock-* classifier refinements are not included.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A heavy PreToolUse that the control layer then denied had already acquired a slot
and, getting no PostToolUse, held it until PTY teardown or the 60 min TTL. The HITL
gate now runs first. Regression test: a control-denied heavy call leaves zero holders.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- NAME_TAG_FONT_SIZE 6->8; ellipsize long roster roles to a fixed 44px plate
  (NAME_TAG_MAX_TEXT_WIDTH) so "Chief Engineer"/"Science Officer" no longer
  overflow across neighboring avatars
- ThoughtBubble inner FONT_SIZE 12->20 (renders ~10px on screen vs the old 6px)

This is the reviewed task-nameplate-ui work (evidence/nameplate-legibility-*.png)
that had been left uncommitted in the working tree; committing it onto the
integration branch so it is actually part of the v0.5 foundation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012BbUnNhhbe9YgB68PvKL98
The Settings modal has exactly one config writer (saveAll); the ported toggle called
updateConfig directly and failed settings-one-save. It now stages like every other
setting and applies on Save (main still reads it live from config).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
feat: rebrand Munder Difflin -> Agent Stage (foundation)
@github-actions

Copy link
Copy Markdown
Contributor

🚫 This PR is missing its before/after evidence

Every pull request here has to show its work. Screenshots or a short screen recording, before the change and after it.

  • Before — no image or video under that heading
  • After — no image or video under that heading

How to fix it: edit the description, keep the ### Before and ### After headings from the template, and drag an image or video under each. GitHub uploads it inline. This check re-runs the moment you save.

A bug fix with no visible surface still needs it: show the failing behaviour, then the same steps passing. A terminal recording is fine.

Genuinely nothing to show — a CI tweak, a typo, a dependency bump? A maintainer can apply the no-visual-change label. Please don't ask unless it truly has no observable effect.

📖 CONTRIBUTING.md → Evidence is mandatory

@jdell64

jdell64 commented Oct 18, 2026

Copy link
Copy Markdown
Author

Closing this misplaced PR; the correct PR is jdell64#2.

@jdell64 jdell64 closed this Oct 18, 2026
@IntelliGlassAIdev

IntelliGlassAIdev commented Oct 19, 2026 via email

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants