mosaic-coder
9d8d58ae75
fix(tools/git): pr-review.sh _belongs case-insensitive repo-slug compare
...
#866 hardened the comment-persistence read-back into a full-path _belongs()
check that pins scheme+host+port origin plus the full path, to block
look-alike-host and same-host decoy-prefix attacks. That check compared the
path case-sensitively: EXPECTED_REPO_SLUG is taken verbatim from
GITEA_API_BASE and can be mixed-case (e.g. "USC/uconnect"), while Gitea
canonicalizes the returned pull_request_url's owner/repo segment to
lowercase. A successful 201 write on a mixed-case-slug repo therefore
false-negatived ("did not land on a pull request") even though the comment
genuinely landed — fail-closed on a real success, not a false success, but
broken for legitimate mixed-case-slug repos.
Lowercase both sides of the path comparison inside _belongs (path and
expected_path) while leaving the origin tuple comparison, _origin_and_path's
scheme+host lowercasing, and the full (non-suffix) path match untouched — the
look-alike-host and decoy-prefix protections from #866 are unchanged; only
the repo-slug segment's case sensitivity is relaxed, which is safe because
Gitea repo slugs are case-insensitive and the remainder of the path is
numeric.
Adds a red-first regression case (comment-mixed-case-slug) modeling a
mixed-case EXPECTED_REPO_SLUG against a Gitea-canonicalized lowercase
pull_request_url, which fails against pre-fix code and passes after.
Closes #875
2026-07-23 12:34:34 -05:00
jason.woltje and Mos
7edc9b3121
fix(gitea): direct REST comment/review with fail-closed read-back ( #865 )
...
Closes #865
Mos (id-11) Gate-16 merge: fresh confirmatory independent APPROVE @8ac7e70f (1241-case fuzz 0 fail-open), author id2 != approver id11, clean commit-author, CI green wp1966.
Co-authored-by: jason.woltje <[email protected] [email protected]
2026-07-23 17:25:32 +00:00
jason.woltje and Mos
48fd1df28a
fix(ci-queue-wait): treat absent branch (404) as queue-clear ( #872 )
...
Closes #872
Mos (id-11) Gate-16 merge: independent review APPROVE @23cbdaf8, author jason.woltje(id2) != approver Mos(id11), CI green wp1974.
Co-authored-by: jason.woltje <[email protected] [email protected]
2026-07-23 17:08:57 +00:00
jason.woltje
344d86a635
fix( #812 follow-up): normalize detect-platform.sh host-match port comparison by scheme ( #859 )
2026-07-20 10:13:29 +00:00
jason.woltje
3b70c66c07
fix(framework): drop unsupported --comment from tea pr approve/reject; route review body via durable comment ( #835 ) ( #857 )
2026-07-20 09:19:48 +00:00
jason.woltje
aa999daf1b
fix(framework): durable Gitea comment posting in pr-review.sh via REST + read-back verify ( #812 ) ( #852 )
2026-07-20 06:45:48 +00:00
jason.woltje
b580d37d51
Fixes #703 ( #705 )
2026-07-12 20:49:43 +00:00
jason.woltje
a99aded26d
fix(tools/git): -h/--help now exits 0 across 7 wrappers ( #702 )
2026-07-11 09:23:46 +00:00
jason.woltje
4df38f7e81
fix(tools/_lib): /etc/mosaic host-level fallback for credential resolution ( #700 )
2026-07-10 01:57:12 +00:00
jason.woltje
e6b53ea103
fix(tools): default AGENT_WORK_ROOT to $HOME/mosaic/agent-work ( #641 )
2026-06-23 13:40:13 +00:00
jason.woltje
bf24066a49
feat(framework): P1+P2 — public sanitization + blocking CI gate ( #572 )
...
Co-authored-by: Jason Woltje <[email protected] [email protected]
2026-06-21 02:40:11 +00:00
jason.woltje
92316ab41e
feat(framework): P0 — MIT license + executable-leak sanitization ( #570 )
...
Co-authored-by: Jason Woltje <[email protected] [email protected]
2026-06-21 01:43:49 +00:00
jason.woltje
57919c38d8
fix(framework/tools): wrapper hardening — TLS validation, cred-path fallback, no-CI fast-exit ( #551 )
2026-06-20 10:16:38 +00:00
jason.woltje
ab4e138003
feat(framework/tools): orchestration helpers — lane-brief.sh + ci-wait.sh ( #547 )
2026-06-18 22:08:40 +00:00
jason.woltje
719c6ac3db
fix(framework/tools): eval injection, broken JSON, tmpfile leak ( #549 )
2026-06-18 21:35:32 +00:00
jason.woltje
98a771c8f8
Fix Gitea wrapper login resolution ( #538 )
2026-06-12 02:34:18 +00:00
jason.woltje
dde95a59b3
fix(pi): reduce startup skill-token overhead ( #527 )
2026-06-05 18:36:42 +00:00
jason.woltje
821e19dcbb
fix(mosaic-tools): roll up Gitea and Woodpecker wrapper fixes ( #524 )
2026-05-26 20:56:09 +00:00
jason.woltje
2e31626f87
fix: simplify updater to @mosaic/mosaic only, add explicit tea repo/login flags ( #388 )
2026-04-05 02:09:23 +00:00
Jason Woltje
b38cfac760
feat: integrate framework files into monorepo under packages/mosaic/framework/
...
Moves all Mosaic framework runtime files from the separate bootstrap repo
into the monorepo as canonical source. The @mosaic/mosaic npm package now
ships the complete framework — bin scripts, runtime configs, tools, and
templates — enabling standalone installation via npm install.
Structure:
packages/mosaic/framework/
├── bin/ 28 CLI scripts (mosaic, mosaic-doctor, mosaic-sync-skills, etc.)
├── runtime/ Runtime adapters (claude, codex, opencode, pi, mcp)
├── tools/ Shell tooling (git, prdy, orchestrator, quality, etc.)
├── templates/ Agent and repo templates
├── defaults/ Default identity files (AGENTS.md, STANDARDS.md, SOUL.md, etc.)
├── install.sh Legacy bash installer
└── remote-install.sh One-liner remote installer
Key files with Pi support and recent fixes:
- bin/mosaic: launch_pi() with skills-local loop
- bin/mosaic-doctor: --fix auto-wiring for all 4 harnesses
- bin/mosaic-sync-skills: Pi as 4th link target, symlink-aware find
- bin/mosaic-link-runtime-assets: Pi settings.json patching
- bin/mosaic-migrate-local-skills: Pi skill roots, symlink find
- runtime/pi/RUNTIME.md + mosaic-extension.ts
Package ships 251 framework files in the npm tarball (278KB compressed).
2026-04-01 21:19:21 -05:00
mosaic-coder
jason.woltjeandMos