Release: Nightly -> Main #267
Open
+28,484
−10,945
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Added UserSecretsStore durable object for secure secret storage and management - Implemented XChaCha20-Poly1305 encryption service for secure secret storage - Heirarchial key derivation
- Increased PBKDF2 iterations to 600k/100k for stronger key derivation - Added memory zeroing for plaintext bytes in encryption/decryption operations - Implemented promise-based locking for key rotation to prevent concurrent modifications - Added detailed security documentation for deterministic salt design and SQL injection prevention - Updated UserSecretsStore to wait for any in-progress key rotation before executing operations - Added comprehensive
…ic coding agent implemented - Abstracted behaviors and objectives - Behavior and Objectives are bot h AgentComponent - CodeGeneratorAgent (Agent DO) houses common business logic - Implemented agentic coding agent and and assistant
- Implemented AI-powered project type prediction (app/workflow/presentation) with confidence scoring and auto-detection when projectType is 'auto' - Enhanced template selection to filter by project type and skip AI selection for single-template scenarios in workflow/presentation types - Added GitHub token caching in CodeGeneratorAgent for persistent OAuth sessions across exports - Updated commitlint config to allow longer commit messages (
- Initialize template cache during agent setup to avoid redundant fetches - Remove redundant project name prompt from template selection - Clean up default projectType fallback logic
- Added concurrency control to prevent duplicate workflow runs on the same PR - Replaced Claude-based comment cleanup with direct GitHub API deletion for better reliability - Enhanced code debugger instructions to handle Vite dev server restarts and config file restrictions
- Replaced unsafe type assertions with proper type guards for legacy state detection - Added explicit type definitions for deprecated state fields and legacy file formats - Eliminated all 'any' types while maintaining backward compatibility with legacy states
…ess design - Sandbox layer does not rely on templates now, instead expects raw files list - Tools to init/list templates, files - Templates can be chosen by agentic mode after creation - Restructured system prompt with detailed architecture explanations covering virtual filesystem, sandbox environment, and deployment flow - Better tool descriptions - Improved communication guidelines and workflow steps for better agent reasoning and execution
- Replaced agent mode toggle with project mode selector (App/Slides/Chat) that determines behavior type - Implemented agentic behavior detection for static content (docs, markdown) with automatic editor view - Conditionally render PhaseTimeline and deployment controls based on behavior type (phasic vs agentic)
- Replaced manual template_manager tool with init_suitable_template that uses the original template selector ai - Updated system prompts to emphasize template-first workflow for interactive projects with AI selector as mandatory first step - Simplified template selection process by removing manual list/select commands in favor of intelligent matching ```
- Added conversation history support to AgenticProjectBuilder with message preparation and context tracking - Implemented tool call completion callbacks to sync messages and trigger periodic compactification - Modified AgenticCodingBehavior to queue user inputs during builds and inject them between tool call chains using abort mechanism
- Fix importTemplate to actually work - Fixed template filtering logic to respect 'general' project type - Added behaviorType to logger context for better debugging - fixed not saving behaviorType to state
…ructor - Moved behaviorType and projectType initialization from hardcoded values to constructor-based setup - Changed initial state values to 'unknown' to ensure proper initialization through behavior constructor - Cleared template details cache when importing new templates to prevent stale data
- Moved user input idle check from PhasicCodingBehavior to CodeGeneratorAgent for consistent behavior across all modes - Fixed message order in agenticProjectBuilder to place history after user message instead of before - Added replaceExisting parameter to addConversationMessage for better control over message updates - Enhanced initial state restoration to include queued user messages and behaviorType - Added status and queuePosition fields
- Single convo id needs to be broadcasted but messages need to be saved with unique ids. - Fix message deduplication to use composite key (conversationId + role + tool_call_id) - Improved tool message filtering to validate against parent assistant tool_calls - Removed unused CodingAgentInterface stub file - Simplified addConversationMessage interface by removing replaceExisting parameter
- Added CompletionDetector interface and CompletionConfig for detecting task completion signals - Implemented dependency-aware parallel tool execution engine with resource conflict detection - Added LoopDetector to prevent infinite tool call loops with contextual warnings - Enhanced ToolCallContext with completion signal tracking and warning injection state - Modified tool execution to respect dependencies and execute in parallel groups
… and debugger - Added CompletionDetector to track completion signals via dedicated tools (mark_generation_complete, mark_debugging_complete) - Implemented LoopDetector to prevent infinite tool call loops with contextual warnings - Created wrapToolsWithLoopDetection utility to inject loop detection into tool execution flow - Enhanced system prompts to emphasize efficient parallel tool usage and completion discipline
Feat: Better tooling system
…at/general-agents
…ging and broadcast
Feat: Prompt improvements + model config updates
- Add defensive PR metadata extraction with fallback environment variables in Claude review workflow - Eliminate modulo bias in recovery code generation using rejection sampling with pooled random values - Consolidate nested Object.values/keys/entries detection in preDeploySafetyGate selector checks
…oization - Wrap async functions in useCallback with proper dependencies in byok-api-keys-modal, config-modal, VaultSetupWizard - Reorder function definitions before useEffect hooks to satisfy dependency arrays in auth-context and vault-context - Add missing dependencies to useEffect and useMemo hooks throughout components - Move categorizeWebSocketMessage and processTimelineData to useCallback in debug-panel - Other lint issue fixes
- Add container/monitor-cli.test.ts to Vitest exclusions (uses bun:test and Bun.* APIs) - Reformat exclude array for better readability
Fix: Linting issues
…gating - Extract AI changelog generation into separate workflow_dispatch workflow (ai-changelog.yml) - Modify release-with-ai-changelog.yml to dispatch ai-changelog workflow instead of inline execution - Add release-please bot detection in claude-reviews gating (author and branch name checks) - Extract HEAD_REF and BASE_REF metadata for improved PR context in claude-reviews - Add debug logging for gating context in claude-reviews workflow
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Feat: add dedicated AI changelog workflow and improve release-please gating
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Add cf-git to ESLint ignores and reformat ignores array for readability - Add targeted react-refresh/only-export-components exceptions for contexts, features, and auth components - Extract HEADER_STYLES to separate view-header-styles module for better organization - Fix React Hook dependency warnings in presentation hooks (use-iframe-messaging, use-thumbnail-observer) - Capture behavior type in variables before conditional
…at/refactor-agents-base
- Bump @sentry packages from 10.29.0 to 10.30.0 - Update agents from 0.2.31 to 0.2.32 - Add cross-spawn 7.0.6 dependency - Upgrade React and React DOM from 19.2.1 to 19.2.3 - Update Hono from 4.10.7 to 4.11.0 - Bump framer-motion, rolldown-vite, and other minor version updates - Update dev dependencies including @cloudflare/workers-types, ESLint, Tailwind CSS, and knip
…ing in chat initialization - Add connection status guard before session creation to prevent race conditions during rerenders - Add validation for required websocketUrl and agentId fields before WebSocket connection - Reset connection status to idle on initialization errors to allow retry - Improve error messages for missing session initialization data
…x/duplicate-agent-session-creation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| PR_TITLE: ${{ github.event.pull_request && github.event.pull_request.title || '' }} | ||
| PR_AUTHOR: ${{ github.event.pull_request && github.event.pull_request.user && github.event.pull_request.user.login || '' }} | ||
| PR_HEAD_REPO: ${{ github.event.pull_request && github.event.pull_request.head && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name || '' }} | ||
| PR_HEAD_REF: ${{ github.event.pull_request && github.event.pull_request.head && github.event.pull_request.head.ref || '' }} |
Contributor
There was a problem hiding this comment.
MEDIUM - Potential Code Injection (Partial Mitigation)
The ${{ github.event.pull_request.head.ref }} value is interpolated directly into the environment variable. While subsequent bash usage quotes the variable, a malicious branch name could still potentially cause issues if it contains shell metacharacters during environment variable expansion.
The current approach is an improvement over direct interpolation in commands, but for maximum safety, consider using toJSON() to properly escape the value:
Suggested change
| PR_HEAD_REF: ${{ github.event.pull_request && github.event.pull_request.head && github.event.pull_request.head.ref || '' }} | |
| PR_HEAD_REF: ${{ toJSON(github.event.pull_request && github.event.pull_request.head && github.event.pull_request.head.ref || '') }} |
Then parse it in the bash script. Alternatively, since you're fetching PR metadata via gh pr view for non-pull_request events anyway, consider always fetching it via API to avoid any interpolation risks.
Note: This is a defense-in-depth recommendation. The existing gating (fork detection, collaborator check) provides good protection against untrusted actors.
…reation Fix: prevent duplicate agent session creation and improve error handling in chat initialization
…at/refactor-agents-base
…rameter in safety gate
- Add CLAUDE_4_5_OPUS model definition (200K context, $5.00 cost) - Add GROK_4_1_FAST_NON_REASONING model definition (2M context, $0.20 cost) - Add QWEN_3_CODER_480B model definition (256K context
Feat: General agents + presentations
- Add MAX_AGENT_QUERY_LENGTH constant (20,000 characters) to agent types - Validate query length in agent controller and return 413 error if exceeded - Add client-side validation in home route and chat hook with user-friendly error messages - Truncate oversized queries during state migration to prevent performance issues - Export MAX_AGENT_QUERY_LENGTH from api-types for frontend usage - Pass skipRateLimitCheck flag in createAgentSession API
feat: add query length validation with 20k character limit
Contributor
|
Claude finished @AshishKumar4's task in 2m 14s —— View job Code Quality & Security ReviewRecommendation: APPROVE PR SummaryMajor release merging nightly changes to main, introducing a new encrypted User Secrets Vault system with client-side cryptography, improved CI/CD workflows with security gating, React code generation safety gate, and enhanced process monitoring with comprehensive test coverage. PR Description
Addressed Issues
Code QualityCritical: None identified High: None identified Medium:
Low:
SecurityCritical: None identified High: None identified Medium:
Low: None identified Security Strengths:
Testing
Breaking Changes Review
Architecture Notes
Final RecommendationAPPROVE - This is a well-implemented release with solid security practices in the new vault system, proper CI/CD hardening, and comprehensive test coverage for the process monitoring changes. The previously flagged security issues have been addressed. The breaking changes are documented and the migration path is clear. Minor suggestions for future improvements:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Major release merging nightly changes to main, featuring a new encrypted User Secrets Vault system, improved CI/CD workflows, enhanced process monitoring, and React safety gate static analysis.
Changes
Vault/Secrets System (New Feature)
UserSecretsStoreDurable Object for secure server-side encrypted storagevault-crypto.ts- Browser-side cryptography (AES-GCM, HKDF, rejection sampling for unbiased RNG)VaultContextReact provider for vault state managementCI/CD & Workflows
ai-changelog.yml- AI-powered changelog generation for releasesclaude-issue-autofix.yml- Automated issue fixing with trusted actor gatingclaude-reviews.ymlwith security improvements and critical path detectionclaude-issue-triage.ymlworkflowci.ymlwith caching and full test/lint/typecheck pipelineCode Generation Safety
preDeploySafetyGate.ts- AST-based static analysis for React antipatternsContainer/Process Monitoring
Database & API
user_secretstable, updatesuser_model_providers/api/vault/*endpoints for vault lifecycleMotivation
This release consolidates security-focused improvements and new features developed on the nightly branch:
Testing
bun run testto execute all tests including vault and monitor suitesBreaking Changes
user_secretsD1 table is dropped (data migrated to Durable Object)Related Issues