 thePR0M3TH3AN
|
d0ea0d96f6
|
Add document workflows, entry graph links, and discovery/docs updates
|
2026-03-01 15:43:43 -05:00 |
|
|
thePR0M3TH3AN
|
68cb1169e3
|
Add agent autonomy controls, docs updates, and landing page agent section
|
2026-03-01 01:02:11 -05:00 |
|
|
thePR0M3TH3AN
|
fe96ccd7c7
|
Add agent security controls, broker auth, and capability discovery
|
2026-02-28 22:32:38 -05:00 |
|
|
thePR0M3TH3AN
|
882cd060fa
|
Fix Python 3.10 compatibility for UTC timezone usage
|
2026-02-25 21:26:32 -05:00 |
|
|
thePR0M3TH3AN
|
fcbe2b2943
|
Harden security item 2: KDF policy, export safeguards, and tests
|
2026-02-25 18:15:51 -05:00 |
|
|
google-labs-jules[bot]andPR0M3TH3AN
|
4a1529fd1a
|
Fix CI failures: linting and dependency vulnerabilities
- Apply code formatting fixes (black) to resolve test workflow failures.
- Update `pyproject.toml`, `src/requirements.txt`, and lock files to upgrade vulnerable dependencies:
- aiohttp -> 3.13.3
- cryptography -> 46.0.5
- orjson -> 3.11.7 (CVE-2025-67221)
- pillow -> 12.1.1 (CVE-2026-25990)
- pynacl -> 1.6.2 (CVE-2025-69277)
- starlette -> 0.52.1 (CVE-2025-62727)
- urllib3 -> 2.6.3 (CVE-2025-66418, etc.)
- cbor2 -> 5.8.0 (CVE-2025-68131)
- pyasn1 -> 0.6.2 (CVE-2026-23490)
- python-multipart -> 0.0.22 (CVE-2026-24486)
- Manually sync `requirements.lock` from `poetry.lock` as `pip-compile` is unavailable in the environment.
Co-authored-by: PR0M3TH3AN <[email protected]>
|
2026-02-25 19:24:01 +00:00 |
|
|
thePR0M3TH3AN
|
0789dfcb55
|
Harden agent policy and API import limits; fix docs links
|
2026-02-23 16:24:53 -05:00 |
|
|
thePR0M3TH3AN
|
03958106e1
|
Add agent mode, hardened TUI harness, coverage gates, and cross-platform installer smoke CI
This commit delivers four related improvements focused on reliability and automation while preserving existing human/TUI workflows.
1) Agent-first CLI mode (additive)
- Added new `seedpass agent` command group (`src/seedpass/cli/agent.py`) and wired it into CLI root.
- Implemented non-interactive profile bootstrap: `seedpass agent init` with `--seed|--seed-file|--generate-seed` and password env injection (`--password-env`).
- Added policy management commands: `agent policy-show` and `agent policy-set` with allow/deny kind controls.
- Added JSON-based secret retrieval: `seedpass -f <fingerprint> agent get <query> --ttl <sec>` with lease metadata and policy enforcement.
- Kept regular human mode fully available; no behavioral changes to interactive TUI entrypoint.
2) TUI agent harness deepening and stabilization
- Refactored harness into scenario profiles: `core`, `extended`, `stress` with `--scenario` selection.
- Added deterministic seeded stress campaigns: `--stress-cycles`, `--stress-seed`.
- Added scenario-specific required coverage keys and report metadata.
- Added post-condition assertions in extended scenario (archive/restore consistency, lock/unlock retrieval recovery).
- Hardened prompt matching for output variants and fail-fast behavior on non-zero SeedPass exit codes.
- Added harness unit tests for helper logic and control flow.
3) Critical module coverage gate tooling
- Added `scripts/check_critical_coverage.py` to enforce per-module thresholds from coverage JSON and report uncovered functions.
- Added override controls (`--threshold`, `--no-default-thresholds`) and optional JSON result output.
- Integrated coverage JSON generation into CI helper script and optional gate execution via `CRITICAL_COVERAGE_GATE=1`.
- Tuned default thresholds using full-suite baseline and increased strictness:
- `src/main.py >= 50%`
- `src/seedpass/core/manager.py >= 60%`
- `src/seedpass/core/encryption.py >= 80%`
- `src/seedpass/core/migrations.py >= 90%`
- Added tests for coverage gate parser/analysis logic and targeted manager worker path tests.
4) Installer validation framework for beta/main
- Added cross-platform installer smoke scripts:
- `scripts/installer_smoke_unix.sh`
- `scripts/installer_smoke_windows.ps1`
- Added GitHub Actions workflow `.github/workflows/installer-smoke.yml` with:
- reduced PR matrix
- full scheduled/manual matrix across OS/branch/mode
- per-job log capture and artifact uploads for failure triage
- Added installer testing documentation and linked from README.
Additional housekeeping
- Added `.venv/` to `.gitignore`.
- Updated docs for new harness scenarios, seeded stress mode, post-condition metadata, coverage gate usage, and installer testing workflow.
|
2026-02-23 15:47:59 -05:00 |
|