slaguru666/AIPass
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,370 Commits 9 Branches 14 Tags
d1facd8bdce0f7966a4161957032f12cd5f37b59
Commit Graph
1370 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
AIOSAI d1facd8bdc fix(skills): TG poll 5xx triggers network backoff — HTTPError >=500 in poll_updates raises _NetworkPollError instead of rapid-fire retry; 4xx unchanged. 3 new tests (502/503 backoff, 429 excluded). Medic loop: detected by @trigger (ERROR ae5ddbd4), fixed autonomously by @skills, verified by devpulse (1080 tests green, seedgo 100%) 2026-07-19 21:20:10 -07:00
AIOSAI 0529a4e7c4 fix(ai_mail): inbox-poller spawn_agent now passes --model DEFAULT_MODEL (sonnet). The daemon asymmetry Vera flagged lived in ai_mail's own handlers/dispatch/daemon.py (name collision, not @daemon branch — their scheduled wakes import wake_branch directly and were covered by efb530e0). DEFAULT_MODEL imported from wake.py, single source; 200k window pin already covered via shared dispatch_monitor wrapper. Test asserts --model in captured spawn cmd. 778 tests green, seedgo 100%, both re-run by devpulse. Investigated by @daemon, built by @ai_mail 2026-07-19 09:32:42 -07:00
AIOSAI efb530e0b2 feat(ai_mail): dispatch default Sonnet 5 — alias pass-through + 200k context pin. MODEL_MAP replaced by KNOWN_MODEL_ALIASES pass-through (CLI resolves latest-in-class, map can never go stale), DEFAULT_MODEL opus->sonnet, dispatch_monitor pins CLAUDE_CODE_AUTO_COMPACT_WINDOW=200000 per spawn (Sonnet 5 is 1M-native — without pin agents inherit 1M window). E2E: live @cli dispatch probe reported claude-sonnet-5 + WINDOW=200000 from inside the spawned session. 777 tests green, seedgo 100%, both re-run by devpulse. Daemon spawn_agent --model gap confirmed, handled separately. Patrick ruling S326, built by @ai_mail 2026-07-19 09:15:04 -07:00
AIOSAI a7108e8504 fix(flow): is_template_content v5.0 — boilerplate-aware Exec Log check closes the N1 false negative. Default-template Exec Log boilerplate (11 lines w/ Log Pattern tip) beat the 8-line user-work threshold before the bracket-marker check ran, so blank plans read as user-written and closed as done (FPLAN-0313/0314). Now boilerplate is recognized and skipped; blank templates reach the marker check. Live-proven: fresh FPLAN-0342 detected+fast-deleted; 730 tests, audit 100%. DPLAN-0250 N1, dispatched to @flow 2026-07-19 03:08:17 -07:00
AIOSAI f09d42a862 fix(flow): lock+atomic registry aggregate writes — S304 F85 residual. save_branch_registry + save_central were bare open+dump; now O_EXCL lockfile with backoff + tmpfile os.replace, matching save_registry.py. Devpulse verified: 730 tests green + 6-proc 180-write concurrent hammer, final file valid JSON. N1 root cause found: is_template_content line threshold fires before bracket-marker check. CHANGELOG entries. DPLAN-0250, dispatched to @flow 2026-07-19 02:55:55 -07:00
AIOSAI c91cfd5166 fix(aipass): doctor stops inventing errors on clean repos — S304 F14-17. .backup+templates excluded from agent scan; relative registry paths anchored to project_root not CWD (killed 5 fake missing-branch errors from branch dirs); severity-honest glyphs (info != PASS). Devpulse live-verified from devpulse dir: zero false registry errors, 1 remaining error is genuine ptest pollution. 756 tests. DPLAN-0250 Track A, dispatched to @aipass 2026-07-19 02:55:45 -07:00
AIOSAI 8cb3895264 fix(spawn): seedgo remediation on is_protected work — narrowed logged excepts (OSError/ValueError/KeyError + logger.info, fallthrough semantics unchanged) and extracted _check_nested_pollution to cut detect_pollution to depth 4. Audit 100% (43/43), 357 tests, probes re-verified (pollution 0, delete aipass refused). DPLAN-0250 Track A follow-up, dispatched to @spawn 2026-07-19 01:18:15 -07:00
AIOSAI d631fd8d54 fix(hooks): pytest-guard the two static-path JSONL writers — S304 F6/F43 closed. diagnostics + telegram_response resolved log paths at import, bypassing prax test routing; now per-write resolvers route to tmp under pytest. Devpulse marker-bounded verify: 1154 tests green, engine.jsonl 1291 lines before AND after, zero suite-attributable entries. CHANGELOG wave entry + prep skill feedback-check habit (F46). DPLAN-0250 Track A, dispatched to @hooks 2026-07-19 01:08:59 -07:00
AIOSAI 48e25ae46e fix(prax): pytest detection immune to env-clearing — S304 F6/F43. Hooks tests patch.dict(os.environ, clear=True) stripped PYTEST_CURRENT_TEST, so loggers minted in that window froze prod-path handlers via the setup cache. get_system/module_logs_dir now also check _pytest in sys.modules. 1032 prax + 1154 hooks tests green. Residual: hooks-owned diagnostics writer bypasses prax resolution — handed to @hooks. DPLAN-0250 Track A, dispatched to @prax 2026-07-19 00:55:07 -07:00
AIOSAI 800acd079a fix(commons): lowercase branch-name normalization across all resolution sites — S304 F52. trade/artifact/profile/welcome/search ops all uppercased vs identity's lowercase (diverged af350fe0), so ownership guards never matched and gifts were invisible. DB sweep confirmed clean (bug blocked bad writes). Live gift+trade round-trip green, 449 tests, seedgo 31/31. DPLAN-0250 Track A, dispatched to @commons 2026-07-19 00:51:43 -07:00
AIOSAI defee1f513 fix(spawn): shared is_protected() guards repair + delete — S304 F30/F84. 3-layer check (infra floor, registry owner, active passport) replaces name-match pollution detection and 3-name delete guard. Live-verified: detect_pollution on AIPass root = 0 issues, delete aipass/devpulse both refused. 357 tests (11 new), seedgo 31/31. DPLAN-0250 Track A, dispatched to @spawn 2026-07-19 00:49:46 -07:00
AIOSAI 7811381d54 fix(hooks-tests): stop test_log_write_failure_does_not_crash minting MagicMock/LOG_FILE dirs — bare-Mock LOG_FILE patch reached prax append_jsonl's real mkdir via mock fspath; now patches a real tmp path. 100/100 green, clean-CWD verified zero dirs minted. S324 scan finding, FYI mailed @hooks 2026-07-18 22:10:05 -07:00
AIOSAI bdb128d904 docs(flow): merge playbook site drift-check step — every merge run asks if install/onboarding/agent-count/platform story changed, aipass.ai updates same day (DPLAN-0249 follow-on, S323 projection ruling). Template edit by @flow, seedgo 42/42 2026-07-18 21:07:10 -07:00
AIPass 9b85a95552 Merge pull request #702 from AIOSAI/dev 
README v3 restructure (DPLAN-0249). Single-funnel story: every command taught exactly once — What-AIPass-Does stripped to pitch, all commands in Quick Start, How-It-Works is now the mental-model section. New hero link line (aipass.ai / PyPI / r/AIPass / Discussions) closes the one-way funnel gap. Three gif slots reserved as comments. Positioning ruling: Claude Code on Linux/WSL only — Codex/macOS/Windows story and Roadmap removed from the README (code support unchanged; Docker distribution is the future answer for those users). CHANGELOG entry included.
 2026-07-18 20:01:03 -07:00
AIOSAI 2213251756 docs(readme): v3 restructure — single-funnel story, site link line, gif slots, Claude-Code-on-Linux/WSL positioning (DPLAN-0249) 2026-07-18 19:43:43 -07:00
AIPass a057cdf488 Merge pull request #701 from AIOSAI/dev 
README: remove stale demo.gif embed. The recording predates the v2.7.3 onboarding chain (welcome mode, aipass new handoff) and no longer matches the product. Re-record with the welcome-back payoff is parked as a follow-up.
 2026-07-18 16:51:11 -07:00
AIOSAI 251b2729c2 docs(readme): drop demo.gif embed — recording predates the v2.7.3 onboarding flow, re-record parked (todo #79) 2026-07-18 16:41:07 -07:00
AIPass 06c1a3a1be Merge pull request #699 from AIOSAI/dev 
aipass new + front-door overhaul + fleet-100: projects/ playground machinery (isolated projects with full framework agents, registry-first credential linkage, birth commits), ai_mail cross-project boundary, seedgo cli_ux + readme_quality standards born from a live door-test, and the fleet-100 sweep bringing all 17 branches to 100% on the expanded gate (FPLAN-0333 / DPLAN-0247)
v2.7.3 		2026-07-18 16:09:52 -07:00
AIOSAI 74bf6eef04 fix(hooks): make test_no_aipass_dir_is_disabled hermetic — the .aipass walk climbs to the drive root, so a real .aipass in any ancestor (windows-setup runner installs AIPass into the runner home, an ancestor of pytest tmp) leaked into the no-dir case. Patch _find_aipass_dir to None for that branch; the walk itself stays covered by the sibling tests 2026-07-18 15:55:23 -07:00
AIOSAI 28e8028a02 fix(hooks): assert the full feedback URL in test_fires_on_turn_10 — kills CodeQL py/incomplete-url-substring-sanitization high alert (substring github.com looked like URL validation to the scanner; full-URL assert is also the stricter test) 2026-07-18 15:43:26 -07:00
AIOSAI 71e5198d4c feat(onboarding): install ends in a conversation — TDPLAN-0014 chain complete + v2.7.3 bump. Dead-end kills: empty-template init runs handoff+report (default path reaches the conversation), non-interactive completes with defaults exit 0 (was EOFError crash — caught by live door-test after green suites), aipass new TTY auto-launch into the manager w/ printed fallback + escape line. Install-to-chat handoff: launch_inline @aipass with authored first prompt + install report context, ONE unified INIT_PROMPT, headless print-only. Welcome Mode branch prompt (opener spec, name-ask, turn-5 triage, hooks-first via real dispatch, WSL beat, exact-command principle) behaviorally door-tested over a live multi-turn run incl second-session momentum. Feedback pulse (@hooks): 10-turn one-liner, aipass feedback on/off alias, disabled on host, live-proven cadence+persistence. README: install-ends-in-conversation story, aipass new documented, non-interactive truth. CHANGELOG + version 2.7.3 both files. seedgo 17/17 100%, local CI gate green 2026-07-18 15:28:44 -07:00
AIPass ef38f3be4c Merge pull request #700 from AIOSAI/dependabot/github_actions/codeql-action-3d2ef569ae 
ci(deps): bump the codeql-action group with 3 updates
 2026-07-18 15:14:34 -07:00
dependabot[bot] db9643eb58 ci(deps): bump the codeql-action group with 3 updates 
Bumps the codeql-action group with 3 updates: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/init` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a)

---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-action
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-18 08:02:58 +00:00
AIOSAI 193336967b feat(aipass-new): agent = full spawn citizen at src/<pkg>/<pkg> (FPLAN-0334). new_project routes through spawn_agent() against spawn's new project_agent template (branch prompt, inbox.json, birth certificate, trinity, house entry point, agent README) - hand-rolled scaffold retired. citizen_class=manager, seat path relative, registry walk stops at project root. Birth commit excludes .venv symlink + registry lock. Boundary verified 4/4 refusals incl ai_mail cross-project check 2026-07-17 22:56:19 -07:00
AIOSAI f6d31285ea fix(seedgo): Debug_Print detector regex matched print( inside string literals - strip string content before matching (+regression test); flatten depth-5 nesting in cli_ux_check. The auditor was the last branch under 100 - fleet now genuinely 17/17 (FPLAN-0333) 2026-07-17 20:17:41 -07:00
AIOSAI d4b265ad45 feat(aipass): aipass new + front-door overhaul, project boundary, cli_ux+readme_quality standards, fleet-100 sweep (FPLAN-0333/DPLAN-0247). aipass new creates isolated projects with full framework agents (registry-first credential linkage, birth commit, drone-resolvable from inside, invisible to host). ai_mail refuses cross-project mail. seedgo gains user-facing-quality standards born from live door-test. 15 branch fronts brought to house pattern - 17/17 branches 100% 2026-07-17 19:29:47 -07:00
AIPass 53a695580f Merge pull request #698 from AIOSAI/dev 
Merge playbook SOP fixes from live run PPLAN-0010
v2.7.2 		2026-07-16 23:43:55 -07:00
AIOSAI 6163202a93 release: bump 2.7.2 — compass v2 + ambient recall window. New cadence ruling: PATCH bump + tag every merge, PyPI tracks main 2026-07-16 23:29:26 -07:00
AIOSAI 4912d96f58 docs(flow): merge playbook SOP fixes from live run PPLAN-0010 — gated fetch step replaced with drone @git sync, create-syntax hint at template top 2026-07-16 23:19:50 -07:00
AIPass 87bfccd55b Merge pull request #697 from AIOSAI/dev 
Startup protocol: announce current PID on greeting
 2026-07-16 23:04:50 -07:00
AIOSAI a89ddb30bd fix(ci): seedgo gate back to 100% — hooks handler logging + silent catches, memory governance modules/handlers split (import path frozen, bridge E2E green), devpulse README test count. All 17 branches 100% 2026-07-16 22:44:01 -07:00
AIOSAI e412cfed14 fix(drone): namespace subprocess timeout to --drone-timeout — plain --timeout passes through to modules (watchdog 600s regression, live repro x2). Regression test, 879 green, CHANGELOG both fixes 2026-07-16 22:04:03 -07:00
AIOSAI b8f6fb8dad fix(memory): plan-ID searches pin the exact plan via metadata lookup (Patrick ruling) + purge 193 scratchpad junk vectors. Live-verified 100% top-hit, 1011 green 2026-07-16 22:03:04 -07:00
AIOSAI 6b0dcdccef fix(memory): governance module ate all @memory commands — standard handle_command signature, declines non-governance commands (Track 2 follow-up). Search verified live, 1011 green 2026-07-16 21:31:10 -07:00
AIOSAI 1902775812 feat(compass): Track 2 ambient recall — compass_recall hook + pure governance (memory) + recall API w/ rare-token scoring (devpulse), verbatim tidbit injection, live acceptance matrix green (DPLAN-0246/FPLAN-0332). 446+1011+1129 tests, seedgo 100% 2026-07-16 20:43:49 -07:00
AIOSAI 03dfce20b4 feat(devpulse): compass curation v2 Track 1 — supersedes links + atomic archive, write-time FTS conflict advisory, note command, --include-archived, score code-removal, review-per-prep (DPLAN-0246/FPLAN-0331). 435 green, seedgo 31/31 2026-07-16 19:45:21 -07:00
AIOSAI b3bb529a6a feat(drone): 3-layer timeout policy — per-command overrides + --timeout flag + 30s default, override hint in error (DPLAN-0245). 878 tests green 2026-07-16 00:09:28 -07:00
AIOSAI 9a61d237fa feat(flow): close pipeline self-completing — auto-vectorization from post_close_runner + locked atomic registry writes (DPLAN-0245). E2E proven, 730 green 2026-07-16 00:09:14 -07:00
AIOSAI 702e335cb8 fix(skills): TG routine read-timeouts silenced on OSError path + outage episode-start demoted ERROR→WARNING per Patrick ruling — ends medic wake-loop. 825 TG tests green 2026-07-15 23:21:41 -07:00
AIOSAI 73e9ededd4 fix(flow): CLOSED_PLANS append race — O_EXCL lockfile with retry/backoff, surface silent append failures (S314 sweep lost 18/21 entries). 730 tests green 2026-07-15 23:21:26 -07:00
AIOSAI bad08e9b03 fix(memory): unwedge plan vectorization — salt vector IDs with source file, per-file batches with incremental manifest (DPLAN-0245). Backlog drained 229/229, 990 tests green 2026-07-15 23:21:11 -07:00
AIOSAIandClaude Fable 5 851988abbc fix(seedgo): DPLAN-0244 trust files to 100% standards — json_handler + justified bypasses 
CI seedgo gate is strict 100%. trust_registry.py now uses json_handler for
registry I/O (log_operation on writes only — no per-hook-event flood);
unused_function bypassed (cross-branch public API, static analysis can't see
callers). trust.py gained print_introspection + --help/no-args gates;
genuinely-N/A standards (json_structure delegated to trust_registry,
frozen cross-branch import) bypassed with justification. Both branches 100%,
all tests green, live acceptance re-verified (attack still blocked both gates).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEAyLFCuo4uD934fwFxocz
 2026-07-15 19:17:45 -07:00
AIOSAIandClaude Fable 5 222a9c8382 docs(navmap): open-source status is fleet-wide identity, not a coding footnote (Patrick ruling) 
Every agent's tier1 navmap now states AIPass is open source in the intro
and reframes the house rule as write-as-if-it-ships. External scans are
contributions, not intrusions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEAyLFCuo4uD934fwFxocz
 2026-07-15 18:23:13 -07:00
AIOSAIandClaude Fable 5 a8b1ce6658 feat(hooks): DPLAN-0244 hooks.json trust model hardening — Layer A engine gates + Layer B registry/CLI 
Closes a zero-interaction RCE where a hostile repo's .aipass/hooks.json
(discovered via loader CWD walk-up, bridge wired globally) could run an
arbitrary command-type hook on SessionStart. Defense-in-depth:

Layer A (engine): refuse command-type hooks from per-project configs via
unconditional _source clobber; gate handler paths to aipass.* namespace.
Layer B (loader+CLI): trusted-project registry (path+sha256), fail-closed
trust-check, $AIPASS_HOME-only bootstrap (no TOFU), aipass init auto-enroll
+ new aipass trust/revoke commands.

Live acceptance test (real bridge, real payload) proves both gates block
independently. 1105 hooks + 133 aipass tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YEAyLFCuo4uD934fwFxocz
 2026-07-15 18:23:02 -07:00
AIOSAI 807924241f docs: startup protocol — announce current PID on greeting (Patrick) 2026-07-15 14:12:55 -07:00
AIPass 91f8cc6c07 Merge pull request #696 from AIOSAI/dev 
Post-v2.7.0 fixes: #692 legacy builder-class migration + birth-cert template, #694 order-dependent test pollution. Both verified live: Vera Studio dry-run plans exactly the 2 passport migrations (zero writes), original repro pair passes, prax+skills+spawn 1576 tests green, skills_json litter eliminated.
v2.7.1 		2026-07-15 13:37:45 -07:00
AIOSAI 989d19020d chore(release): bump 2.7.0 -> 2.7.1 — supply-chain hardening (DPLAN-0243: commit signing, hash-pinned CI tooling, release provenance attestation), TG streaming v2 polish, rate_tracker burst-evasion fix, CI green pass 2026-07-15 13:24:41 -07:00
AIOSAI b4f66ce84d docs(flow): merge playbook template — DPLAN-0243 new-setup notes (auto-SSH-signing, hash-pinned CI advisory mode, provenance attestation step). Built by @flow, 730/730 green, seedgo 100% 2026-07-15 13:19:29 -07:00
AIOSAI 294d25cea3 docs: CHANGELOG entry for DPLAN-0243 supply-chain hardening (signing, hash-pinned CI, provenance, hvtracker#186) 2026-07-15 12:36:19 -07:00
AIOSAI 9048666c65 ci: OSSF scorecard hardening (DPLAN-0243) — hash-pin all standalone workflow pip installs via .github/requirements/ locks (pip/lint/build/e2e/audit, pip-compile --generate-hashes, 11/11 target-env closure verified incl. Windows colorama marker fix) + provenance attestation on publish (attest-build-provenance v4.1.1 SHA-pinned, id-token+attestations perms) + dependabot pip ecosystem for the new locks. Editable -e . installs untouched byte-identical. 5/5 fresh-venv --require-hashes installs green, 5/5 YAML parse, pinned ruff matches repo lint. First SSH-signed commit (repo config wired this session). 2026-07-15 12:21:22 -07:00