Skip to content

v2.4.0: the cockpit and the human inbox - #4

Merged
Param-Harrison merged 9 commits into
mainfrom
release/v2.4.0
Sep 24, 2026
Merged

Param-Harrison merged 9 commits into
mainfrom
release/v2.4.0

Conversation

@Param-Harrison

Copy link
Copy Markdown
Contributor

What shipped

  • src/inbox.ts and factory inbox [<N> <action>] [--json]: one list of what waits on a human. Acting posts the same /factory comment a human types, so GitHub stays the only state.
  • Dashboard redesign, no build step: machinist tokens, self-hosted Manrope (OFL), Line / Inbox / Runs / Analytics, run side sheet with an artifact viewer, mobile bottom nav.
  • Dashboard auth: constant-time token compare, header or HttpOnly cookie, no ?token=, default-deny route allow-list proven by a route-walk test.
  • factory logs, control-sequence stripping, revision history; ports from owainlewis/machinist and assembler (MIT) with upstream tests and a provenance test.
  • Fixes found by the live run: reset left SQLite WAL files, runner and dashboard raced on a fresh database, make up gave the dashboard no repo, factory inbox --repo X misread the flag as an issue number.

Left out

Merge dry-run inbox item (v2.9), Agents page (v2.6). The session cookie still carries the raw token (opaque session ids are a follow-up). factory inbox argument parsing has no direct test.

Verification

  • make check green, 339 tests. Each new structural test (route walk, visual system, WAL wipe, concurrent open) failed with its fix reverted.
  • Live on splitbill #52: plan approved from the dashboard, verify parked, retried with factory inbox 52 retry, shipped as PR #58 ($2.82).
  • Verifier agent: auth, traversal, symlink and provenance checks all held. It saw one failure of the concurrent-open test that I could not reproduce in about 25 further runs; I added a bounded retry on a locked open and made the test print child stderr.
  • Screenshots at 3 widths and both themes taken; kept outside the repo.

🤖 Generated with Claude Code

Param-Harrison and others added 9 commits September 24, 2026 10:06
…d plain(); add provenance test

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
One derived list of everything waiting on a human, acting through the same
/factory comments a human types. A structural test walks every waiting label.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Routes live in one table walked by a test. The token is compared in constant
time, is header or session cookie only, and artifacts are sent as text with
sandbox headers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Machinist design tokens, self-hosted Manrope, mobile bottom nav, run side
sheet with artifact viewer, /api/line and public /assets routes, and a
visual-system structural test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…en reading positionals

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
… the race test

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@Param-Harrison
Param-Harrison merged commit 7732af5 into main Sep 24, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant