20 Commits

Author	SHA1	Message	Date
mosaic-coder	9d8d58ae75	fix(tools/git): pr-review.sh _belongs case-insensitive repo-slug compare ... #866 hardened the comment-persistence read-back into a full-path _belongs() check that pins scheme+host+port origin plus the full path, to block look-alike-host and same-host decoy-prefix attacks. That check compared the path case-sensitively: EXPECTED_REPO_SLUG is taken verbatim from GITEA_API_BASE and can be mixed-case (e.g. "USC/uconnect"), while Gitea canonicalizes the returned pull_request_url's owner/repo segment to lowercase. A successful 201 write on a mixed-case-slug repo therefore false-negatived ("did not land on a pull request") even though the comment genuinely landed — fail-closed on a real success, not a false success, but broken for legitimate mixed-case-slug repos. Lowercase both sides of the path comparison inside _belongs (path and expected_path) while leaving the origin tuple comparison, _origin_and_path's scheme+host lowercasing, and the full (non-suffix) path match untouched — the look-alike-host and decoy-prefix protections from #866 are unchanged; only the repo-slug segment's case sensitivity is relaxed, which is safe because Gitea repo slugs are case-insensitive and the remainder of the path is numeric. Adds a red-first regression case (comment-mixed-case-slug) modeling a mixed-case EXPECTED_REPO_SLUG against a Gitea-canonicalized lowercase pull_request_url, which fails against pre-fix code and passes after. Closes #875	2026-07-23 12:34:34 -05:00
jason.woltje	7edc9b3121	fix(gitea): direct REST comment/review with fail-closed read-back (#865) ... Closes #865 Mos (id-11) Gate-16 merge: fresh confirmatory independent APPROVE @8ac7e70f (1241-case fuzz 0 fail-open), author id2 != approver id11, clean commit-author, CI green wp1966. Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>	2026-07-23 17:25:32 +00:00
jason.woltje	48fd1df28a	fix(ci-queue-wait): treat absent branch (404) as queue-clear (#872) ... Closes #872 Mos (id-11) Gate-16 merge: independent review APPROVE @23cbdaf8, author jason.woltje(id2) != approver Mos(id11), CI green wp1974. Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>	2026-07-23 17:08:57 +00:00
jason.woltje	344d86a635	fix(#812 follow-up): normalize detect-platform.sh host-match port comparison by scheme (#859)	2026-07-20 10:13:29 +00:00
jason.woltje	3b70c66c07	fix(framework): drop unsupported --comment from tea pr approve/reject; route review body via durable comment (#835) (#857)	2026-07-20 09:19:48 +00:00
jason.woltje	aa999daf1b	fix(framework): durable Gitea comment posting in pr-review.sh via REST + read-back verify (#812) (#852)	2026-07-20 06:45:48 +00:00
jason.woltje	b580d37d51	Fixes #703 (#705)	2026-07-12 20:49:43 +00:00
jason.woltje	a99aded26d	fix(tools/git): -h/--help now exits 0 across 7 wrappers (#702)	2026-07-11 09:23:46 +00:00
jason.woltje	4df38f7e81	fix(tools/_lib): /etc/mosaic host-level fallback for credential resolution (#700)	2026-07-10 01:57:12 +00:00
jason.woltje	e6b53ea103	fix(tools): default AGENT_WORK_ROOT to $HOME/mosaic/agent-work (#641)	2026-06-23 13:40:13 +00:00
Jason Woltje	bf24066a49	feat(framework): P1+P2 — public sanitization + blocking CI gate (#572) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 02:40:11 +00:00
Jason Woltje	92316ab41e	feat(framework): P0 — MIT license + executable-leak sanitization (#570) ... Co-authored-by: Jason Woltje <jason@diversecanvas.com> Co-committed-by: Jason Woltje <jason@diversecanvas.com>	2026-06-21 01:43:49 +00:00
jason.woltje	57919c38d8	fix(framework/tools): wrapper hardening — TLS validation, cred-path fallback, no-CI fast-exit (#551)	2026-06-20 10:16:38 +00:00
jason.woltje	ab4e138003	feat(framework/tools): orchestration helpers — lane-brief.sh + ci-wait.sh (#547)	2026-06-18 22:08:40 +00:00
jason.woltje	719c6ac3db	fix(framework/tools): eval injection, broken JSON, tmpfile leak (#549)	2026-06-18 21:35:32 +00:00
jason.woltje	98a771c8f8	Fix Gitea wrapper login resolution (#538)	2026-06-12 02:34:18 +00:00
jason.woltje	dde95a59b3	fix(pi): reduce startup skill-token overhead (#527)	2026-06-05 18:36:42 +00:00
jason.woltje	821e19dcbb	fix(mosaic-tools): roll up Gitea and Woodpecker wrapper fixes (#524)	2026-05-26 20:56:09 +00:00
jason.woltje	2e31626f87	fix: simplify updater to @mosaic/mosaic only, add explicit tea repo/login flags (#388)	2026-04-05 02:09:23 +00:00
Jason Woltje	b38cfac760	feat: integrate framework files into monorepo under packages/mosaic/framework/ ... Moves all Mosaic framework runtime files from the separate bootstrap repo into the monorepo as canonical source. The @mosaic/mosaic npm package now ships the complete framework — bin scripts, runtime configs, tools, and templates — enabling standalone installation via npm install. Structure: packages/mosaic/framework/ ├── bin/ 28 CLI scripts (mosaic, mosaic-doctor, mosaic-sync-skills, etc.) ├── runtime/ Runtime adapters (claude, codex, opencode, pi, mcp) ├── tools/ Shell tooling (git, prdy, orchestrator, quality, etc.) ├── templates/ Agent and repo templates ├── defaults/ Default identity files (AGENTS.md, STANDARDS.md, SOUL.md, etc.) ├── install.sh Legacy bash installer └── remote-install.sh One-liner remote installer Key files with Pi support and recent fixes: - bin/mosaic: launch_pi() with skills-local loop - bin/mosaic-doctor: --fix auto-wiring for all 4 harnesses - bin/mosaic-sync-skills: Pi as 4th link target, symlink-aware find - bin/mosaic-link-runtime-assets: Pi settings.json patching - bin/mosaic-migrate-local-skills: Pi skill roots, symlink find - runtime/pi/RUNTIME.md + mosaic-extension.ts Package ships 251 framework files in the npm tarball (278KB compressed).	2026-04-01 21:19:21 -05:00