test_daemon_start_with_json had a silent JSONDecodeError pass that
would hide regressions. test_invalid_path_gives_error ended with
assert True which doesn't verify any actual behavior.
The change_directory function was updating session.working_dir even
when the backend returned an error. This could leave the session in an
invalid directory state and break subsequent relative-path operations.
The act type command was echoing the full text value in non-JSON mode,
which could leak passwords or PII into terminal scrollback and logs.
Now only outputs the target path without the typed text.
Update documentation to clarify that daemon mode works within a single
process (REPL or --daemon flag) and that state does not persist across
separate CLI invocations.
Avoid invoking npx during test collection by requiring DOMSHELL_E2E=1
environment variable. This prevents unwanted side effects when running
pytest in environments without DOMShell.
Store the stdio_client context manager to ensure proper cleanup
when stopping daemon mode. Previously, __aexit__ was called on a new
instance, causing subprocess leaks.
Instead of reconstructing navigation via open_url(), directly use the
DOMShell MCP tools for back/forward navigation. This ensures
proper browser history tracking.
- Add auto-save via result_callback so --project flag triggers disk
write after every mutating command, fixing broken consecutive
operations in non-REPL mode.
- Switch REPL arg parsing from str.split() to shlex.split() so that
quoted strings with spaces (e.g. --text "Summer Sale") are handled
correctly.
Fixes#111
- save_history() now writes to session JSON so history survives restarts
- Use fcntl.flock exclusive locking on session writes (ported from blender harness)
- Reset modified flag after _save()
- Remove sys.path.insert; rely on proper package installation
- clear() also resets history
Addresses review feedback from sehawq on #101.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Implement novita/agent-harness with OpenAI-compatible API client
- Add chat completion, streaming, model listing support
- Include CLI with chat, session, and config commands
- Add tests with mocked API calls
- Update registry.json with Novita entry
- Update .gitignore to include novita/
- Resolve merge conflict in README.md test badge (1,684 → 1,720)
- Update all app/demo counts from 14 → 16 to reflect all CLIs in registry
- Update test counts: 1,247 unit + 473 e2e = 1,720 total
- Add AdGuardHome entry to registry.json with contributor info (pyxl-dev)
- Add contributor/contributor_url fields to all registry entries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- log_config: trigger POST when --interval is passed without --enabled,
read current config for missing parameters
- set_enabled: read current filter interval from server instead of
hardcoding 24h
- Update test mock to cover the new get_status call in set_enabled
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add section explaining the behavior change for callers using non-listed
codecs, with instructions on how to extend the allowlists.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Deduplicate logical document paths by freshest metadata so open-path resolves real Mubu history duplicates consistently. Overlay backup-driven show/link output with metadata titles and doc paths, and default new public state to ~/.config/mubu-cli while preserving legacy fallback.
extra_args could pass vcodec=..., acodec=..., or -consumer to override
the validated codec parameters. Add _validate_extra_args() that rejects
any argument starting with these prefixes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When an AI agent constructs CLI commands, it may pass arbitrary strings as
codec parameters — either through prompt injection, hallucination, or
processing untrusted input. Since codec values are passed directly to
melt/ffmpeg subprocesses, unvalidated input is an injection risk.
Fix: add ALLOWED_VCODECS / ALLOWED_ACODECS allowlists to both kdenlive
and shotcut melt_backend.py. All codec parameters are validated before
reaching subprocess.run(). Unknown codecs raise ValueError with a list
of valid options.
Also add SECURITY.md documenting the project's threat model (AI agents
as CLI callers), attack surfaces, reporting process, and security
guidelines for harness developers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update the package metadata, generated skill output, test expectations, and registry entry so the contribution PR reflects the generalized daily-folder behavior in the published harness version.
Furkan Köykıran