Three harnesses shipped without the SKILL.md skill definition introduced
in Phase 6.5, and their setup.py files lacked the package_data entry
needed for pip install to include the skill file. This means agents
cannot discover these CLIs through the standard skill system.
Changes:
- Add skills/SKILL.md for adguardhome (12 command groups, 36+ commands)
- Add skills/SKILL.md for comfyui (5 command groups: workflow, queue,
models, images, system)
- Add skills/SKILL.md for mermaid (4 command groups: project, diagram,
export, session)
- Fix adguardhome/setup.py: add package_data and include_package_data
- Fix mermaid/setup.py: add package_data and include_package_data
- Fix comfyui/setup.py: add package_data for skills (was missing despite
include_package_data=True already being set)
- Add comfyui to .gitignore allow-list (was tracked before the gitignore
was tightened, but new files could not be added)
- Expand test_skill_path.py HARNESSES list from 11 to all 18 harnesses
- Fix test assertion to accept mubu-style explicit SKILL.md reference
alongside the glob pattern used by other harnesses
Test results: 79 passed (was 51 tests covering only 11 harnesses)
- Add auto-save via result_callback so --project flag triggers disk
write after every mutating command, fixing broken consecutive
operations in non-REPL mode.
- Switch REPL arg parsing from str.split() to shlex.split() so that
quoted strings with spaces (e.g. --text "Summer Sale") are handled
correctly.
Fixes#111
- save_history() now writes to session JSON so history survives restarts
- Use fcntl.flock exclusive locking on session writes (ported from blender harness)
- Reset modified flag after _save()
- Remove sys.path.insert; rely on proper package installation
- clear() also resets history
Addresses review feedback from sehawq on #101.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Implement novita/agent-harness with OpenAI-compatible API client
- Add chat completion, streaming, model listing support
- Include CLI with chat, session, and config commands
- Add tests with mocked API calls
- Update registry.json with Novita entry
- Update .gitignore to include novita/
- Resolve merge conflict in README.md test badge (1,684 → 1,720)
- Update all app/demo counts from 14 → 16 to reflect all CLIs in registry
- Update test counts: 1,247 unit + 473 e2e = 1,720 total
- Add AdGuardHome entry to registry.json with contributor info (pyxl-dev)
- Add contributor/contributor_url fields to all registry entries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- log_config: trigger POST when --interval is passed without --enabled,
read current config for missing parameters
- set_enabled: read current filter interval from server instead of
hardcoding 24h
- Update test mock to cover the new get_status call in set_enabled
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add section explaining the behavior change for callers using non-listed
codecs, with instructions on how to extend the allowlists.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Deduplicate logical document paths by freshest metadata so open-path resolves real Mubu history duplicates consistently. Overlay backup-driven show/link output with metadata titles and doc paths, and default new public state to ~/.config/mubu-cli while preserving legacy fallback.
extra_args could pass vcodec=..., acodec=..., or -consumer to override
the validated codec parameters. Add _validate_extra_args() that rejects
any argument starting with these prefixes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When an AI agent constructs CLI commands, it may pass arbitrary strings as
codec parameters — either through prompt injection, hallucination, or
processing untrusted input. Since codec values are passed directly to
melt/ffmpeg subprocesses, unvalidated input is an injection risk.
Fix: add ALLOWED_VCODECS / ALLOWED_ACODECS allowlists to both kdenlive
and shotcut melt_backend.py. All codec parameters are validated before
reaching subprocess.run(). Unknown codecs raise ValueError with a list
of valid options.
Also add SECURITY.md documenting the project's threat model (AI agents
as CLI callers), attack surfaces, reporting process, and security
guidelines for harness developers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update the package metadata, generated skill output, test expectations, and registry entry so the contribution PR reflects the generalized daily-folder behavior in the published harness version.
Require an explicit daily folder reference or MUBU_DAILY_FOLDER for daily helpers, scrub personal examples from docs and generated skill content, and harden live E2E checks for environment-specific SSL failures.
Okyumi