slaguru666/AIPass
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,363 Commits 9 Branches 14 Tags
0beaac2133451afa68c90348e07ec3cda8798fd9
Commit Graph
1363 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
tevansandClaude Opus 5 0beaac2133 Loosen surfacing governance defaults 
Local tuning — recall was too quiet in practice. After one surface the
old defaults required 10 further messages AND 300s before another, so a
second relevant memory almost never appeared in a working session.

  threshold                0.30 -> 0.25
  max_surfaces_per_session    5 -> 12
  min_messages_between       10 -> 2
  cooldown_seconds          300 -> 30

test_first_surface_ignores_spacing now passes an explicit config, so it
exercises the spacing mechanism rather than tracking whatever the
defaults happen to be. The value pin is updated to match.

Not for upstream — keep off fix/passport-traits-email.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-27 14:09:16 +01:00
tevansandClaude Opus 5 e9c13ed7a1 Sort imports in test_citizen_classes.py 
Two pre-existing ruff I001 violations in the file this PR touches:
pathlib grouped after pytest at module level, and a stdlib import
adjacent to a first-party one inside test_update_cli_accepts_class_with_all.

Formatting only — no test behaviour changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-27 13:53:01 +01:00
tevansandClaude Opus 5 e0e9b289cc Add regression tests for passport traits and email 
Covers both halves of the fix: that the templates reference {{TRAITS}}
and {{EMAIL}}, and that a created agent ends up with the rendered values.

Includes the no-flag case — omitting --traits must leave an empty string,
since the identity hook skips the line when falsy and a missing key would
change existing behaviour.

All five fail against the pre-fix templates.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-27 13:50:20 +01:00
tevansandClaude Opus 5 2efb4e8645 Populate traits and email in agent passport templates 
`drone @spawn create --traits "..."` accepted the flag and silently
discarded it: the TRAITS placeholder is built in placeholders.py but no
template referenced it. Same for EMAIL — the registry recorded @<agent>
while the passport had no email key, so the identity hook rendered
"Email: unknown" for every agent.

Both placeholders were already wired; only the templates needed to use
them. Applied to aipass_framework and project_agent alike.

The identity hook reads traits as either list or string and skips the
line when falsy, so an agent created without --traits is unchanged.

Also regenerates aipass_framework's .template_registry.json, which drops
seven stale .pytest_cache entries for files not present in the template.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-27 13:40:13 +01:00
AIPass 5e36909e53 Merge pull request #709 from AIOSAI/dependabot/github_actions/actions/setup-python-7.0.0 
ci(deps): bump actions/setup-python from 6.3.0 to 7.0.0
 2026-07-26 06:53:33 -07:00
dependabot[bot] 948c65725c ci(deps): bump actions/setup-python from 6.3.0 to 7.0.0 
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.3.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/ece7cb06caefa5fff74198d8649806c4678c61a1...5fda3b95a4ea91299a34e894583c3862153e4b97)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-25 08:03:10 +00:00
AIPass 9b85a95552 Merge pull request #702 from AIOSAI/dev 
README v3 restructure (DPLAN-0249). Single-funnel story: every command taught exactly once — What-AIPass-Does stripped to pitch, all commands in Quick Start, How-It-Works is now the mental-model section. New hero link line (aipass.ai / PyPI / r/AIPass / Discussions) closes the one-way funnel gap. Three gif slots reserved as comments. Positioning ruling: Claude Code on Linux/WSL only — Codex/macOS/Windows story and Roadmap removed from the README (code support unchanged; Docker distribution is the future answer for those users). CHANGELOG entry included.
 2026-07-18 20:01:03 -07:00
AIOSAI 2213251756 docs(readme): v3 restructure — single-funnel story, site link line, gif slots, Claude-Code-on-Linux/WSL positioning (DPLAN-0249) 2026-07-18 19:43:43 -07:00
AIPass a057cdf488 Merge pull request #701 from AIOSAI/dev 
README: remove stale demo.gif embed. The recording predates the v2.7.3 onboarding chain (welcome mode, aipass new handoff) and no longer matches the product. Re-record with the welcome-back payoff is parked as a follow-up.
 2026-07-18 16:51:11 -07:00
AIOSAI 251b2729c2 docs(readme): drop demo.gif embed — recording predates the v2.7.3 onboarding flow, re-record parked (todo #79) 2026-07-18 16:41:07 -07:00
AIPass 06c1a3a1be Merge pull request #699 from AIOSAI/dev 
aipass new + front-door overhaul + fleet-100: projects/ playground machinery (isolated projects with full framework agents, registry-first credential linkage, birth commits), ai_mail cross-project boundary, seedgo cli_ux + readme_quality standards born from a live door-test, and the fleet-100 sweep bringing all 17 branches to 100% on the expanded gate (FPLAN-0333 / DPLAN-0247)
v2.7.3 		2026-07-18 16:09:52 -07:00
AIOSAI 74bf6eef04 fix(hooks): make test_no_aipass_dir_is_disabled hermetic — the .aipass walk climbs to the drive root, so a real .aipass in any ancestor (windows-setup runner installs AIPass into the runner home, an ancestor of pytest tmp) leaked into the no-dir case. Patch _find_aipass_dir to None for that branch; the walk itself stays covered by the sibling tests 2026-07-18 15:55:23 -07:00
AIOSAI 28e8028a02 fix(hooks): assert the full feedback URL in test_fires_on_turn_10 — kills CodeQL py/incomplete-url-substring-sanitization high alert (substring github.com looked like URL validation to the scanner; full-URL assert is also the stricter test) 2026-07-18 15:43:26 -07:00
AIOSAI 71e5198d4c feat(onboarding): install ends in a conversation — TDPLAN-0014 chain complete + v2.7.3 bump. Dead-end kills: empty-template init runs handoff+report (default path reaches the conversation), non-interactive completes with defaults exit 0 (was EOFError crash — caught by live door-test after green suites), aipass new TTY auto-launch into the manager w/ printed fallback + escape line. Install-to-chat handoff: launch_inline @aipass with authored first prompt + install report context, ONE unified INIT_PROMPT, headless print-only. Welcome Mode branch prompt (opener spec, name-ask, turn-5 triage, hooks-first via real dispatch, WSL beat, exact-command principle) behaviorally door-tested over a live multi-turn run incl second-session momentum. Feedback pulse (@hooks): 10-turn one-liner, aipass feedback on/off alias, disabled on host, live-proven cadence+persistence. README: install-ends-in-conversation story, aipass new documented, non-interactive truth. CHANGELOG + version 2.7.3 both files. seedgo 17/17 100%, local CI gate green 2026-07-18 15:28:44 -07:00
AIPass ef38f3be4c Merge pull request #700 from AIOSAI/dependabot/github_actions/codeql-action-3d2ef569ae 
ci(deps): bump the codeql-action group with 3 updates
 2026-07-18 15:14:34 -07:00
dependabot[bot] db9643eb58 ci(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-18 08:02:58 +00:00
AIOSAI 193336967b feat(aipass-new): agent = full spawn citizen at src/<pkg>/<pkg> (FPLAN-0334). new_project routes through spawn_agent() against spawn's new project_agent template (branch prompt, inbox.json, birth certificate, trinity, house entry point, agent README) - hand-rolled scaffold retired. citizen_class=manager, seat path relative, registry walk stops at project root. Birth commit excludes .venv symlink + registry lock. Boundary verified 4/4 refusals incl ai_mail cross-project check 2026-07-17 22:56:19 -07:00
AIOSAI f6d31285ea fix(seedgo): Debug_Print detector regex matched print( inside string literals - strip string content before matching (+regression test); flatten depth-5 nesting in cli_ux_check. The auditor was the last branch under 100 - fleet now genuinely 17/17 (FPLAN-0333) 2026-07-17 20:17:41 -07:00
AIOSAI d4b265ad45 feat(aipass): aipass new + front-door overhaul, project boundary, cli_ux+readme_quality standards, fleet-100 sweep (FPLAN-0333/DPLAN-0247). aipass new creates isolated projects with full framework agents (registry-first credential linkage, birth commit, drone-resolvable from inside, invisible to host). ai_mail refuses cross-project mail. seedgo gains user-facing-quality standards born from live door-test. 15 branch fronts brought to house pattern - 17/17 branches 100% 2026-07-17 19:29:47 -07:00
AIPass 53a695580f Merge pull request #698 from AIOSAI/dev 
Merge playbook SOP fixes from live run PPLAN-0010
v2.7.2 		2026-07-16 23:43:55 -07:00
AIOSAI 6163202a93 release: bump 2.7.2 — compass v2 + ambient recall window. New cadence ruling: PATCH bump + tag every merge, PyPI tracks main 2026-07-16 23:29:26 -07:00
AIOSAI 4912d96f58 docs(flow): merge playbook SOP fixes from live run PPLAN-0010 — gated fetch step replaced with drone @git sync, create-syntax hint at template top 2026-07-16 23:19:50 -07:00
AIPass 87bfccd55b Merge pull request #697 from AIOSAI/dev 
Startup protocol: announce current PID on greeting
 2026-07-16 23:04:50 -07:00
AIOSAI a89ddb30bd fix(ci): seedgo gate back to 100% — hooks handler logging + silent catches, memory governance modules/handlers split (import path frozen, bridge E2E green), devpulse README test count. All 17 branches 100% 2026-07-16 22:44:01 -07:00
AIOSAI e412cfed14 fix(drone): namespace subprocess timeout to --drone-timeout — plain --timeout passes through to modules (watchdog 600s regression, live repro x2). Regression test, 879 green, CHANGELOG both fixes 2026-07-16 22:04:03 -07:00
AIOSAI b8f6fb8dad fix(memory): plan-ID searches pin the exact plan via metadata lookup (Patrick ruling) + purge 193 scratchpad junk vectors. Live-verified 100% top-hit, 1011 green 2026-07-16 22:03:04 -07:00
AIOSAI 6b0dcdccef fix(memory): governance module ate all @memory commands — standard handle_command signature, declines non-governance commands (Track 2 follow-up). Search verified live, 1011 green 2026-07-16 21:31:10 -07:00
AIOSAI 1902775812 feat(compass): Track 2 ambient recall — compass_recall hook + pure governance (memory) + recall API w/ rare-token scoring (devpulse), verbatim tidbit injection, live acceptance matrix green (DPLAN-0246/FPLAN-0332). 446+1011+1129 tests, seedgo 100% 2026-07-16 20:43:49 -07:00
AIOSAI 03dfce20b4 feat(devpulse): compass curation v2 Track 1 — supersedes links + atomic archive, write-time FTS conflict advisory, note command, --include-archived, score code-removal, review-per-prep (DPLAN-0246/FPLAN-0331). 435 green, seedgo 31/31 2026-07-16 19:45:21 -07:00
AIOSAI b3bb529a6a feat(drone): 3-layer timeout policy — per-command overrides + --timeout flag + 30s default, override hint in error (DPLAN-0245). 878 tests green 2026-07-16 00:09:28 -07:00
AIOSAI 9a61d237fa feat(flow): close pipeline self-completing — auto-vectorization from post_close_runner + locked atomic registry writes (DPLAN-0245). E2E proven, 730 green 2026-07-16 00:09:14 -07:00
AIOSAI 702e335cb8 fix(skills): TG routine read-timeouts silenced on OSError path + outage episode-start demoted ERROR→WARNING per Patrick ruling — ends medic wake-loop. 825 TG tests green 2026-07-15 23:21:41 -07:00
AIOSAI 73e9ededd4 fix(flow): CLOSED_PLANS append race — O_EXCL lockfile with retry/backoff, surface silent append failures (S314 sweep lost 18/21 entries). 730 tests green 2026-07-15 23:21:26 -07:00
AIOSAI bad08e9b03 fix(memory): unwedge plan vectorization — salt vector IDs with source file, per-file batches with incremental manifest (DPLAN-0245). Backlog drained 229/229, 990 tests green 2026-07-15 23:21:11 -07:00
AIOSAIandClaude Fable 5 851988abbc fix(seedgo): DPLAN-0244 trust files to 100% standards — json_handler + justified bypasses 
CI seedgo gate is strict 100%. trust_registry.py now uses json_handler for
registry I/O (log_operation on writes only — no per-hook-event flood);
unused_function bypassed (cross-branch public API, static analysis can't see
callers). trust.py gained print_introspection + --help/no-args gates;
genuinely-N/A standards (json_structure delegated to trust_registry,
frozen cross-branch import) bypassed with justification. Both branches 100%,
all tests green, live acceptance re-verified (attack still blocked both gates).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEAyLFCuo4uD934fwFxocz
 2026-07-15 19:17:45 -07:00
AIOSAIandClaude Fable 5 222a9c8382 docs(navmap): open-source status is fleet-wide identity, not a coding footnote (Patrick ruling) 
Every agent's tier1 navmap now states AIPass is open source in the intro
and reframes the house rule as write-as-if-it-ships. External scans are
contributions, not intrusions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEAyLFCuo4uD934fwFxocz
 2026-07-15 18:23:13 -07:00
AIOSAIandClaude Fable 5 a8b1ce6658 feat(hooks): DPLAN-0244 hooks.json trust model hardening — Layer A engine gates + Layer B registry/CLI 
Closes a zero-interaction RCE where a hostile repo's .aipass/hooks.json
(discovered via loader CWD walk-up, bridge wired globally) could run an
arbitrary command-type hook on SessionStart. Defense-in-depth:

Layer A (engine): refuse command-type hooks from per-project configs via
unconditional _source clobber; gate handler paths to aipass.* namespace.
Layer B (loader+CLI): trusted-project registry (path+sha256), fail-closed
trust-check, $AIPASS_HOME-only bootstrap (no TOFU), aipass init auto-enroll
+ new aipass trust/revoke commands.

Live acceptance test (real bridge, real payload) proves both gates block
independently. 1105 hooks + 133 aipass tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEAyLFCuo4uD934fwFxocz
 2026-07-15 18:23:02 -07:00
AIOSAI 807924241f docs: startup protocol — announce current PID on greeting (Patrick) 2026-07-15 14:12:55 -07:00
AIPass 91f8cc6c07 Merge pull request #696 from AIOSAI/dev 
Post-v2.7.0 fixes: #692 legacy builder-class migration + birth-cert template, #694 order-dependent test pollution. Both verified live: Vera Studio dry-run plans exactly the 2 passport migrations (zero writes), original repro pair passes, prax+skills+spawn 1576 tests green, skills_json litter eliminated.
v2.7.1 		2026-07-15 13:37:45 -07:00
AIOSAI 989d19020d chore(release): bump 2.7.0 -> 2.7.1 — supply-chain hardening (DPLAN-0243: commit signing, hash-pinned CI tooling, release provenance attestation), TG streaming v2 polish, rate_tracker burst-evasion fix, CI green pass 2026-07-15 13:24:41 -07:00
AIOSAI b4f66ce84d docs(flow): merge playbook template — DPLAN-0243 new-setup notes (auto-SSH-signing, hash-pinned CI advisory mode, provenance attestation step). Built by @flow, 730/730 green, seedgo 100% 2026-07-15 13:19:29 -07:00
AIOSAI 294d25cea3 docs: CHANGELOG entry for DPLAN-0243 supply-chain hardening (signing, hash-pinned CI, provenance, hvtracker#186) 2026-07-15 12:36:19 -07:00
AIOSAI 9048666c65 ci: OSSF scorecard hardening (DPLAN-0243) — hash-pin all standalone workflow pip installs via .github/requirements/ locks (pip/lint/build/e2e/audit, pip-compile --generate-hashes, 11/11 target-env closure verified incl. Windows colorama marker fix) + provenance attestation on publish (attest-build-provenance v4.1.1 SHA-pinned, id-token+attestations perms) + dependabot pip ecosystem for the new locks. Editable -e . installs untouched byte-identical. 5/5 fresh-venv --require-hashes installs green, 5/5 YAML parse, pinned ruff matches repo lint. First SSH-signed commit (repo config wired this session). 2026-07-15 12:21:22 -07:00
AIOSAI 25fc02d07a feat: TG streaming v2 polish (DPLAN-0229) — logs_were_active + multi-chunk (>4096) finalize now honor the streaming flag: logs-active reconcile-edits the streamed message instead of Done.+fresh, multi-chunk edits chunk 1 in place + sends [2/N] continuations, edit-fail falls back safely. Batch path verified zero-change via regression tests. 6 new tests, 1077 hooks green + seedgo 100% devpulse-verified. Live streamed-turn proof pending Patrick's next streaming session. 2026-07-15 11:14:05 -07:00
AIOSAI 9dc2ecd604 feat: rate_tracker v1.2.0 burst-evasion fix — severity evaluates max(instant_rate, 60s window avg): bursty runaways (20 lines/6s retry-loop shape, 200/min avg, previously 4min undetected live) now sustain through gap windows; continuous unchanged, subsidence clears. 4 new burst tests, 1032 green + seedgo 100% devpulse-verified, live-proven from running service: RUNAWAY WARNING prax_burst_storm_test.log 191 lines/min sustained 120s. 2026-07-15 10:45:38 -07:00
AIOSAI 13ae64cbae fix: unpark the parked CI reds — Patrick ruling: red CI is never parked. @prax: relay mtime-cache flake root-caused (test relied on two writes sharing one mtime-granularity window — true locally, false on CI) — os.utime pins mtime so the cache contract tests deterministically, 50/50+20/20 loops green. @hooks: 4 Windows session_boot reds — _tmux_session_exists() real subprocess spawn (no tmux on Windows, WinError 2) mocked per ca096295 convention, execvp already mocked = zero real spawns left. 1028 prax + 102 session_boot green, devpulse-verified. 2026-07-15 10:26:09 -07:00
AIOSAI 024cf5a104 fix: pin sys.platform=linux in test_is_pid_alive_dead — Windows runners take the OpenProcess path so the os.kill mock never fires; test reds whenever PID 1234 is alive on the runner (first hit today, 6/6 sibling tests were already pinned by ca096295). 38 presence tests green. 2026-07-15 09:03:01 -07:00
AIOSAI be68d23d6a fix: CI green pass on PR#696 — lint (ruff format on trigger runaway tests), seedgo 100% both red branches (@hooks: new json_handler + persistent_alert/alert_dismiss wired through it, cc_sessions introspection gate, _menu_live nesting extraction, 1071 tests; @prax: rate_tracker DI refactor — module layer injects logs_dir + trigger.fire via configure(), 1028 tests), navmap trim 9.3k→7.9k under injection cap. All owner-fixed via dispatch, devpulse-verified: both audits 100% independently re-run, full runaway chain re-proven live post-refactor (332 lines/min storm → WARNING at 130s → trigger → @aipass triage → alert banner rendered in-session → dismiss clears). Burst-evasion design finding (pre-existing, not regression) filed to @prax by mail. 2026-07-15 08:49:21 -07:00
AIOSAI 81658ce0ea feat: runaway-log detection + escalation (DPLAN-0242, agent-designed) + citizen wake-back. Prax-led three-branch build via TDPLAN-0013: prax rate_tracker (disk-persisted volume detection, WARNING >100 l/min 2min / CRITICAL >10 l/s 1min, 4th monitor thread) + drone @prax log-health; trigger runaway_log_detected event + handler (per-file 30min cooldown independent of medic breaker, UNKNOWN->prax, writes .aipass/alerts.json); hooks persistent_alert banner + drone @hooks dismiss (devpulse fixed nearest-.aipass path bug in both + wired settings.json - registration is not deployment). Live-fire proven: planted 240 l/min storm -> detect 257 l/min -> event -> dispatch -> @aipass autonomous no-action triage -> banner -> dismiss. ai_mail wake ruling: owner-gate removed (citizen wake-back live-proven), devpulse structurally unwakeable (manager check all paths), self-wake loop found+fixed same night (guard + senderless wake-back sessions). Navmap comms section, 4 branch READMEs + root README + CHANGELOG. ~77 new tests, suites green: prax 1028, trigger 619, hooks 1071, ai_mail 765 2026-07-15 00:05:02 -07:00
AIOSAI de109846bf fix: prax TG relay offline backoff — network-class send failures enter offline mode (1s-60s doubling, flush gate skips sends, monitor loop never blocks, viewers keep rendering), log-once (enter + 5min summary + recovery w/ drop count), full reset on first success. Found live in Patrick's plug-pull: bots went quiet right, relay spun Send failed every 5s (89 lines) + self-fed via log watcher re-ingest. 11 new tests, 1007 prax green devpulse-verified 2026-07-14 17:01:23 -07:00