3 Commits

Author	SHA1	Message	Date
Hermes Agent	b0b2c20da0	fix(framework/tools): eval injection, broken JSON, tmpfile leak (#548) ... F-01 (HIGH): issue-edit.sh and issue-assign.sh used string interpolation + eval to build CLI commands. Replace all eval sites with Bash arrays so user-supplied values (title, body, labels) are never shell-expanded. For the Gitea path, replace get_gitea_repo_args() (which emits %q-escaped strings designed for eval) with get_repo_slug() + get_gitea_login() so repo/login are passed as properly-quoted array elements. F-07 (MED): milestone-create.sh built the GitHub API JSON payload by string interpolation — a title containing " or $ broke the JSON. Rebuild with jq -n --arg so all values are safely serialised. Optional description key is omitted when empty, preserving existing behaviour. F-13 (LOW): pr-metadata.sh created a mktemp tmpfile inside curl_gitea_pull() but only removed it in success paths. Add trap 'rm -f "$body_file"' EXIT immediately after mktemp so early-exit paths (set -e, SIGINT) also clean up. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Kt2D8TsnDwhtzEAPijsNmR	2026-06-18 13:51:18 -05:00
jason.woltje	98a771c8f8	Fix Gitea wrapper login resolution (#538)	2026-06-12 02:34:18 +00:00
Jason Woltje	b38cfac760	feat: integrate framework files into monorepo under packages/mosaic/framework/ ... Moves all Mosaic framework runtime files from the separate bootstrap repo into the monorepo as canonical source. The @mosaic/mosaic npm package now ships the complete framework — bin scripts, runtime configs, tools, and templates — enabling standalone installation via npm install. Structure: packages/mosaic/framework/ ├── bin/ 28 CLI scripts (mosaic, mosaic-doctor, mosaic-sync-skills, etc.) ├── runtime/ Runtime adapters (claude, codex, opencode, pi, mcp) ├── tools/ Shell tooling (git, prdy, orchestrator, quality, etc.) ├── templates/ Agent and repo templates ├── defaults/ Default identity files (AGENTS.md, STANDARDS.md, SOUL.md, etc.) ├── install.sh Legacy bash installer └── remote-install.sh One-liner remote installer Key files with Pi support and recent fixes: - bin/mosaic: launch_pi() with skills-local loop - bin/mosaic-doctor: --fix auto-wiring for all 4 harnesses - bin/mosaic-sync-skills: Pi as 4th link target, symlink-aware find - bin/mosaic-link-runtime-assets: Pi settings.json patching - bin/mosaic-migrate-local-skills: Pi skill roots, symlink find - runtime/pi/RUNTIME.md + mosaic-extension.ts Package ships 251 framework files in the npm tarball (278KB compressed).	2026-04-01 21:19:21 -05:00