config: canonical document authoring TUI and web UI

[yourconscience]

Adds a local-first editor for dotagents.yaml in the terminal and browser, backed by one comment-preserving YAML document model. The web UI is a mobile-friendly Catppuccin Mocha settings page with selection-only controls; full YAML editing stays in the TUI and config file. Saves are revision guarded and separate from sync, while sync requires a reviewed plan digest and explicit destructive confirmation. The server remains loopback-only with token bootstrap, strict cookies, origin and CSRF checks, and no built-in usage page.

[sourcery-ai]

Sorry @yourconscience, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 2 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 62841ce1-18ed-45da-8d8c-29ee5ec4fb88

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Adds a shared, comment-preserving canonical YAML authoring system with Bubble Tea TUI and authenticated loopback web UI, including local overlays, revision-safe atomic saves, reviewed diffs, explicit sync planning, and the new ui.links schema.

Sequence diagram for revision-safe config editing and sync

sequenceDiagram
    participant User
    participant UI as TUI_or_Web_UI
    participant Doc as configDocument
    participant YAML as YAML_layers
    participant Sync as Sync_planner
    participant Harness as Native_harnesses

    User->>UI: edit config
    UI->>Doc: validateRaw or operationsRaw
    Doc->>YAML: preserve YAML nodes and unknown fields
    YAML-->>Doc: candidate YAML
    Doc-->>UI: validation result and unifiedConfigDiff
    User->>UI: save
    UI->>Doc: saveRaw(expectedRevision, raw)
    Doc->>Doc: revisionOf and validateRaw
    Doc->>YAML: atomicConfigWrite
    YAML-->>Doc: saved layer
    Doc-->>UI: configSave with revision and diff
    User->>UI: preview sync
    UI->>Sync: buildConfigSyncPlan
    Sync-->>UI: plan digest and destructive items
    User->>UI: confirm apply
    UI->>Sync: runSync
    Sync->>Harness: update native configurations

Loading

State diagram for config layers and explicit synchronization

stateDiagram-v2
    [*] --> Shared
    [*] --> Local
    Shared --> Effective: mergeConfig
    Local --> Effective: overlay
    Effective --> Effective: read-only
    Shared --> Validating: validateRaw
    Local --> Validating: validateRaw
    Validating --> Review: unifiedConfigDiff
    Review --> Shared: saveRaw
    Review --> Local: saveRaw
    Shared --> SyncPreview: buildConfigSyncPlan
    Local --> SyncPreview: buildConfigSyncPlan
    SyncPreview --> SyncConfirmed: confirmed plan
    SyncConfirmed --> NativeHarnesses: runSync

Loading

File-Level Changes

Change	Details	Files
Introduces a shared canonical YAML document service for safe, revision-aware, layer-specific authoring.	Loads shared and local YAML as nodes while decoding typed configuration and applying effective overlay semantics. Performs stable-key structured mutations, raw YAML validation, SHA-256 stale-write detection, unified diff generation, and atomic mode-preserving writes. Routes setup and MCP whole-document writers through the shared service and adds typed ui.links validation.	cmd/dotagents/config_document.go cmd/dotagents/config_document_test.go cmd/dotagents/config.go cmd/dotagents/main.go cmd/dotagents/mcp_cli.go cmd/dotagents/setup_scaffold.go
Adds the dotagents config command family and a Bubble Tea YAML authoring workflow.	Adds interactive shared/local/effective layer selection, in-terminal YAML editing, validation, diff review, save, stale-revision handling, and explicit sync preview/apply controls. Adds non-interactive config validate and config print commands.	cmd/dotagents/config_tui.go cmd/dotagents/main.go cmd/dotagents/cli_launch_test.go
Adds an embedded loopback web authoring surface with revision-aware configuration and sync APIs.	Embeds standalone HTML, CSS, and ES-module assets without a frontend runtime dependency. Exposes state, validation, raw/structured mutation, status, sync preview, and digest/revision-guarded sync apply endpoints. Implements loopback bind enforcement, startup-token bootstrap, SameSite session cookies, origin and CSRF checks, security headers, and secret masking/redaction.	cmd/dotagents/config_web.go cmd/dotagents/config_document_test.go cmd/dotagents/web/index.html cmd/dotagents/web/app.js cmd/dotagents/web/style.css
Documents canonical configuration authoring and separates it from HarnessKit inspection.	Adds command usage and local-overlay/web security guidance to README, setup, and skill documentation. Adds the implementation specification, acceptance criteria, deviations, and release-site messaging.	README.md SPEC.md docs/setup.md docs/site/index.html skills/dotagents/SKILL.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

New security issues found

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89d870a6f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[sourcery-ai]

New security issues found

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.