87 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
dev	86683297af	Merge pull request 'feat(DIS-104): global semaphore for max_concurrent_agents cap' (#44) from phase-1/concurrency-semaphore into main ... Reviewed-on: #44	2026-04-09 15:30:01 +00:00
dev	0a4cd53b71	Merge pull request 'docs(DIS-110): add cli-feature-probe.md for Phase 2 sanity checks' (#43) from phase-1/cli-probe into main ... Reviewed-on: #43	2026-04-09 15:25:57 +00:00
dev	a7786aff30	Merge pull request 'chore(DIS-109): add vitest.config.ts, complete .env.example, test scripts' (#42) from phase-1/vitest-setup into main ... Reviewed-on: #42	2026-04-09 15:12:38 +00:00
Nick Tabeling	1cafaabe2a	feat(DIS-101): introduce pino structured logger, remove console.* ... Replace all console.* calls in src/ with pino child-loggers. Add rootLogger + childLogger(component) in src/runtime/logger.ts. pino-pretty used as dev transport only. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 17:09:37 +02:00
Nick Tabeling	04450bb6d9	feat(DIS-104): global semaphore for max_concurrent_agents cap ... Add Semaphore class in src/runtime/concurrency.ts. Runner acquires/releases slot around claude spawn. Default cap: 4, configurable via disclaw.yaml max_concurrent_agents. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 17:08:58 +02:00
Nick Tabeling	e3ce0857be	docs(DIS-110): add cli-feature-probe.md for Phase 2 sanity checks ... Manual probe script covering session_id field path, --resume flow, stream-json event types, and usage block field names. Must be executed and filled in before Phase 2 release. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 17:08:52 +02:00
Nick Tabeling	fa176c74ef	chore(DIS-109): add vitest.config.mts, complete .env.example, test scripts ... Add vitest.config.mts with node environment and v8 coverage. Add test:watch and test:coverage scripts to package.json. Complete .env.example with all config fields from loader.ts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 17:08:39 +02:00
dev	0bb320f3b1	Merge pull request 'docs: known issues and future feature ideas (KI-001�003, SF-001�004)' (#41) from docs/ideas-and-known-issues into main ... Reviewed-on: #41	2026-04-09 15:01:35 +00:00
Nick Tabeling	242bb0d34e	docs: add known issues and future feature ideas to docs/ideas/ ... KI-001: Tool-Permission-Popups blockieren Agents lautlos KI-002: Workspace-Wiederherstellung nach Datenverlust KI-002.1: Management-Channel auto-recreate bei Löschung KI-003: Token-Verbrauch durch vollständige History-Injection SF-001: Multi-Agent-Kollaboration & Projekt-Workspaces SF-002: Konversationelles Agent-Design per Chat SF-003: Security-Bot-Schicht & Permission-Management SF-004: Vollständige Discord-Feature-Nutzung Forgejo Issues #33–#40 angelegt (type:known-issue / type:idea). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 16:57:44 +02:00
dev	4661892820	Merge pull request 'fix: remove --bare flag to restore OAuth login for Claude Pro/Max' (#32) from fix/remove-bare-flag into main ... Reviewed-on: #32	2026-04-09 11:56:24 +00:00
Nick Tabeling	aad45b9637	fix: remove --bare flag to restore OAuth login for Claude Pro/Max ... --bare disables OAuth/keychain auth and requires ANTHROPIC_API_KEY, breaking Claude Pro/Max subscriptions. CLAUDE.md isolation is now achieved structurally: workspaces live under ~/.disclaw/workspaces/ (outside the repo) so walk-up never reaches DisClaw's CLAUDE.md. Update integration test to assert --bare is absent and verify correct args (-p, --output-format json). Fix sanitize-env tests to reflect CI=true removal (was breaking OAuth headless-mode detection). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 13:48:45 +02:00
dev	f27af2401a	Merge pull request 'chore: add dist/ to .gitignore, remove from tracking' (#31) from fix/ci-env-login into main ... Reviewed-on: #31	2026-04-09 11:29:19 +00:00
dev	a386e3f5b5	Merge pull request '.gitignore aktualisiert' (#30) from dev-patch-1 into main ... Reviewed-on: #30	2026-04-09 11:27:24 +00:00
dev	b3b9ecb6c2	.gitignore aktualisiert	2026-04-09 11:27:11 +00:00
Nick Tabeling	a48c342912	chore: add dist/ to .gitignore, remove from tracking	2026-04-09 13:25:19 +02:00
dev	fc9c229f92	Merge pull request 'fix(env): remove CI=true -- breaks Claude Code OAuth login' (#29) from fix/ci-env-login into main ... Reviewed-on: #29	2026-04-09 11:19:14 +00:00
Nick Tabeling	ca461d0da6	fix(env): remove CI=true from sanitizedEnv, breaks Claude Code OAuth login	2026-04-09 13:18:25 +02:00
dev	5765cf285f	Merge pull request 'DIS-008: Forgejo Actions CI (build, test, lint)' (#28) from phase-0/ci-pipeline into main ... Reviewed-on: #28	2026-04-09 10:55:54 +00:00
dev	f0d6c62347	Merge pull request 'DIS-007: Lock-File gegen Doppelstart' (#27) from phase-0/startup-lockfile into main ... Reviewed-on: #27	2026-04-09 10:55:29 +00:00
Nick Tabeling	c2a264f6d0	feat(ci): add Forgejo Actions pipeline with build, test, lint ... - Add .forgejo/workflows/ci.yml with matrix (ubuntu/windows), build, test, lint jobs - Add .eslintrc.cjs with shell:true guard (no-restricted-syntax) and @typescript-eslint rules - Add lint script to package.json and ESLint v8 devDependencies - Add CI section to README.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 11:49:48 +02:00
Nick Tabeling	dc4a1ef241	feat(runtime): add startup lockfile to prevent double-start ... Implements acquireLock() in src/runtime/lockfile.ts that writes a PID-stamped lock file under workspaces_root, detects live vs stale locks via process.kill(pid, 0), and returns a release function. src/index.ts acquires the lock before DB init and releases it in the graceful-shutdown handler. Four unit tests cover acquire, duplicate- acquire rejection, stale-lock recovery, and release.	2026-04-09 11:49:17 +02:00
dev	0c512a0cbc	Merge pull request 'DIS-005: Path-Traversal-Check in /new-agent' (#25) from phase-0/path-traversal-check into main ... Reviewed-on: #25	2026-04-09 09:44:54 +00:00
dev	90e7cf37ab	Merge pull request 'DIS-006: settings.json-Template haerten + CLAUDE.md Injection-Klausel' (#24) from phase-0/harden-settings-and-claudemd into main ... Reviewed-on: #24	2026-04-09 09:44:33 +00:00
dev	613758e912	Merge branch 'main' into phase-0/path-traversal-check	2026-04-09 09:43:41 +00:00
dev	3cb9a5c636	Merge pull request 'DIS-004: Runner mit --bare + --append-system-prompt-file aufrufen' (#26) from phase-0/bare-and-append-identity into main ... Reviewed-on: #26	2026-04-09 09:43:25 +00:00
Nick Tabeling	a54918c3be	feat(runner): add --bare and --append-system-prompt-file flags ... Prevents CLAUDE.md walk-up through parent directories by passing --bare to every Claude CLI invocation, and explicitly injects the workspace CLAUDE.md via --append-system-prompt-file so agent identity is isolated. Adds fake-claude fixture and integration test to verify flags are present. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 11:22:44 +02:00
Nick Tabeling	b4cc00e93c	fix(new-agent): add path traversal containment check ... Extracts validateAgentName() with path.resolve containment guard after regex validation; returns clean ephemeral Discord reply on violation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 11:19:28 +02:00
Nick Tabeling	028ea0bf28	feat(identity): harden settings.json template, add injection-resistance clause ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 11:19:19 +02:00
dev	390661eea9	Merge pull request 'DIS-001: Workspace-Root nach ~/.disclaw/workspaces/ verschieben' (#23) from phase-0/workspace-root-home into main ... Reviewed-on: #23	2026-04-09 09:00:27 +00:00
Nick Tabeling	d71081d2b1	feat(config): move workspaces_root to home dir, add tilde expansion ... - disclaw.yaml: change default workspaces_root to ~/.disclaw/workspaces - src/config/loader.ts: add expandWorkspacesRoot() with ~ expansion via os.homedir(), path.resolve() normalisation, and in-repo warning via console.warn (explains CLAUDE.md walk-up leak risk) - tests/unit/workspace-root-resolve.test.ts: Vitest unit tests (a-d) - README.md: add Migration bestehender Workspaces section Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 10:40:34 +02:00
Nick Tabeling	510969b2d1	fix(runner): add sanitizedEnv, remove process.env passthrough ... Introduces src/runtime/env.ts with a pure sanitizedEnv() function that strips DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, DISCORD_PUBLIC_KEY, and all keys matching /^(DISCLAW_SECRET_|SECRET_|TOKEN_|API_KEY_?)/i before passing the environment to spawned Claude Code child processes. Adds optional env_blocklist field to DisclawConfig. Runner now passes DISCLAW_AGENT_NAME and respects the blocklist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-09 10:39:06 +02:00
dev	b20f1fa769	Merge pull request 'DIS-002: shell:false + cross-spawn Windows-Fix im Runner' (#21) from phase-0/harden-spawn into main ... Reviewed-on: #21	2026-04-09 08:34:43 +00:00
Nick Tabeling	bade6d07f6	fix(runner): replace shell:true with cross-spawn, add resolveClaude ... - Remove shell:true from runner.ts (command injection vector closed) - Import cross-spawn instead of child_process.spawn; add windowsHide:true - Add src/runtime/resolve-claude.ts: CLAUDE_PATH env override, where/which PATH fallback, in-memory cache, clear error message on not-found - Add tests/unit/resolve-claude.test.ts: 5 Vitest tests covering env override, PATH fallback, multi-line output trimming, error case, and cache behaviour - Add cross-spawn + @types/cross-spawn to package.json; add vitest + test script	2026-04-09 10:29:58 +02:00
dev	59c5a0c387	Merge pull request 'forgejo management-token + organization/tasks created + workflow/board' (#20) from phase-pre/organization into main ... Reviewed-on: #20	2026-04-08 14:49:30 +00:00
Nick Tabeling	d8f70aa188	forgejo management-token + organization/tasks created + workflow/board	2026-04-08 16:44:12 +02:00
Nick Tabeling	8ca3ebffde	dist-folder	2026-04-08 14:24:45 +02:00
Nick Tabeling	69e0b7d727	initial	2026-04-08 14:21:19 +02:00