ms-lead-reviewer
34e66675f0
feat(tools/git): per-agent Gitea identity (git-credential-mosaic + get_gitea_token)
...
Adds an opt-in per-agent Gitea identity so a fleet agent can push/commit/open
PRs under its own token instead of the single shared account, giving
cryptographic author-!=-reviewer separation (Gate-16).
Resolution priority (both tools): MOSAIC_GIT_IDENTITY env > git config
mosaic.gitIdentity (per-worktree, persists on disk) > git-supplied username
(git-credential-mosaic only). If the resolved identity has a token file at
~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<id>.token, that
identity is used; otherwise both tools fall through to the existing
shared-account path unchanged, so this is a no-op on any host without
per-slot tokens configured.
- tools/git/git-credential-mosaic: new git credential helper (get verb).
- tools/git/detect-platform.sh: get_gitea_token() gains the same identity
resolution, prepended ahead of the existing shared-token logic, so API
tooling (pr-create.sh, issue-create.sh, ...) authors under the same
identity as git push/fetch.
- install.sh: explicit chmod +x for git-credential-mosaic (it ships without
a .sh suffix, so the existing *.sh glob does not cover it); tools/** is
already framework-owned so the file syncs automatically.
- tools/git/README.md: documents the feature, the one-time
`git config credential.helper` registration step (deliberately not
auto-wired — see README for why), and the PowerShell-parity decision
(detect-platform.ps1 authenticates via tea logins, not a raw-token
function, so there is nothing to port there).
- tools/git/test-git-credential-mosaic.sh,
tools/git/test-gitea-token-identity.sh: new regression harnesses (red
verified against the pre-patch code) covering identity-resolution
priority, per-host token path selection, and shared-account fallback.
Wired into package.json's test:framework-shell.
Upstreams Mos host-local tooling-patch kit (2026-07-23), Patches 1+2.
Closes #873
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-07-23 12:32:23 -05:00
7edc9b3121
fix(gitea): direct REST comment/review with fail-closed read-back ( #865 )
...
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
Closes #865
Mos (id-11) Gate-16 merge: fresh confirmatory independent APPROVE @8ac7e70f (1241-case fuzz 0 fail-open), author id2 != approver id11, clean commit-author, CI green wp1966.
Co-authored-by: jason.woltje <jason@diversecanvas.com >
Co-committed-by: jason.woltje <jason@diversecanvas.com >
2026-07-23 17:25:32 +00:00
48fd1df28a
fix(ci-queue-wait): treat absent branch (404) as queue-clear ( #872 )
...
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was canceled
Closes #872
Mos (id-11) Gate-16 merge: independent review APPROVE @23cbdaf8, author jason.woltje(id2) != approver Mos(id11), CI green wp1974.
Co-authored-by: jason.woltje <jason@diversecanvas.com >
Co-committed-by: jason.woltje <jason@diversecanvas.com >
2026-07-23 17:08:57 +00:00
344d86a635
fix( #812 follow-up): normalize detect-platform.sh host-match port comparison by scheme ( #859 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 10:13:29 +00:00
3b70c66c07
fix(framework): drop unsupported --comment from tea pr approve/reject; route review body via durable comment ( #835 ) ( #857 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 09:19:48 +00:00
aa999daf1b
fix(framework): durable Gitea comment posting in pr-review.sh via REST + read-back verify ( #812 ) ( #852 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-20 06:45:48 +00:00
b580d37d51
Fixes #703 ( #705 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline failed
2026-07-12 20:49:43 +00:00
a99aded26d
fix(tools/git): -h/--help now exits 0 across 7 wrappers ( #702 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-11 09:23:46 +00:00
4df38f7e81
fix(tools/_lib): /etc/mosaic host-level fallback for credential resolution ( #700 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was successful
2026-07-10 01:57:12 +00:00
e6b53ea103
fix(tools): default AGENT_WORK_ROOT to $HOME/mosaic/agent-work ( #641 )
ci/woodpecker/push/publish Pipeline was successful
ci/woodpecker/push/ci Pipeline was canceled
2026-06-23 13:40:13 +00:00
bf24066a49
feat(framework): P1+P2 — public sanitization + blocking CI gate ( #572 )
...
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
Co-authored-by: Jason Woltje <jason@diversecanvas.com >
Co-committed-by: Jason Woltje <jason@diversecanvas.com >
2026-06-21 02:40:11 +00:00
92316ab41e
feat(framework): P0 — MIT license + executable-leak sanitization ( #570 )
...
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
Co-authored-by: Jason Woltje <jason@diversecanvas.com >
Co-committed-by: Jason Woltje <jason@diversecanvas.com >
2026-06-21 01:43:49 +00:00
57919c38d8
fix(framework/tools): wrapper hardening — TLS validation, cred-path fallback, no-CI fast-exit ( #551 )
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-06-20 10:16:38 +00:00
ab4e138003
feat(framework/tools): orchestration helpers — lane-brief.sh + ci-wait.sh ( #547 )
ci/woodpecker/push/ci Pipeline failed
ci/woodpecker/push/publish Pipeline was canceled
2026-06-18 22:08:40 +00:00
719c6ac3db
fix(framework/tools): eval injection, broken JSON, tmpfile leak ( #549 )
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was canceled
2026-06-18 21:35:32 +00:00
98a771c8f8
Fix Gitea wrapper login resolution ( #538 )
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-06-12 02:34:18 +00:00
dde95a59b3
fix(pi): reduce startup skill-token overhead ( #527 )
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-06-05 18:36:42 +00:00
821e19dcbb
fix(mosaic-tools): roll up Gitea and Woodpecker wrapper fixes ( #524 )
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-05-26 20:56:09 +00:00
2e31626f87
fix: simplify updater to @mosaic/mosaic only, add explicit tea repo/login flags ( #388 )
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/push/publish Pipeline was successful
2026-04-05 02:09:23 +00:00
Jason Woltje
b38cfac760
feat: integrate framework files into monorepo under packages/mosaic/framework/
...
ci/woodpecker/push/ci Pipeline was successful
ci/woodpecker/pr/ci Pipeline was successful
Moves all Mosaic framework runtime files from the separate bootstrap repo
into the monorepo as canonical source. The @mosaic/mosaic npm package now
ships the complete framework — bin scripts, runtime configs, tools, and
templates — enabling standalone installation via npm install.
Structure:
packages/mosaic/framework/
├── bin/ 28 CLI scripts (mosaic, mosaic-doctor, mosaic-sync-skills, etc.)
├── runtime/ Runtime adapters (claude, codex, opencode, pi, mcp)
├── tools/ Shell tooling (git, prdy, orchestrator, quality, etc.)
├── templates/ Agent and repo templates
├── defaults/ Default identity files (AGENTS.md, STANDARDS.md, SOUL.md, etc.)
├── install.sh Legacy bash installer
└── remote-install.sh One-liner remote installer
Key files with Pi support and recent fixes:
- bin/mosaic: launch_pi() with skills-local loop
- bin/mosaic-doctor: --fix auto-wiring for all 4 harnesses
- bin/mosaic-sync-skills: Pi as 4th link target, symlink-aware find
- bin/mosaic-link-runtime-assets: Pi settings.json patching
- bin/mosaic-migrate-local-skills: Pi skill roots, symlink find
- runtime/pi/RUNTIME.md + mosaic-extension.ts
Package ships 251 framework files in the npm tarball (278KB compressed).
2026-04-01 21:19:21 -05:00
