Repository navigation
Consolidate Classic into Ledger and protect drafts and local APIs - #262
Conversation
--- updated-dependencies: - dependency-name: openai-codex dependency-version: 0.160.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) from 1.20.0 to 1.21.0. - [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases) - [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md) - [Commits](xberg-io/tree-sitter-language-pack@v1.20.0...v1.21.0) --- updated-dependencies: - dependency-name: tree-sitter-language-pack dependency-version: 1.21.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.24.2 to 0.24.3. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@3ad7283...66cbf4b) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
The dashboard now has one interface. Each capability Classic had was rebuilt into the Ledger view where people look for it, then Classic was removed: - Library: Markdown rendering (DOM-only renderer, never parses HTML) with a Write/Preview editor, unsaved-changes guard and Ctrl/Cmd+S; word-level history diffs; per-memory audit trail; drag and Alt+Arrow ordering; one Import menu (Quick import of files, folders or a server path, document import, code indexing and PostgreSQL schema import). - Ask: per-result retrieval scores. Home: memory health and the selected project's last-session handoff (GET /api/proactive gains `repo`). - Explore: colour by cluster, type or connections, palettes, editable type colours, a legend, an entity and relation explorer, keyboard navigation. - Activity: bi-temporal Timeline cards with a superseded-only filter (replacing the Supersessions tab), receipt-chain status, packed-context accounting. - Settings: workspace Describe, Copy, Merge, Export and Delete; plan status and plan-aware hosted messages; automation run status and proposals. - Everywhere: connection and semantic-search banners, an accessible in-page dialog instead of native confirm/prompt, Solarized and Sepia themes. Removed: engraphis/classic_assets, the duplicate engraphis/static tree, the dashboard switcher, the graph compat adapter, and the Marked and DOMPurify copies. /classic redirects to /. Shipped dashboard assets drop from 3.51 MB in three trees to 1.85 MB in one. Hardening found on the way: the zero-config API refuses requests a browser marks as cross-site unless they passed a CORS preflight; the Markdown renderer is linear on adversarial input; dialogs drop bidi controls; secure erase sends its required confirmation; a stalled graph download no longer blocks Reload; the CSP release gate covers Ledger and every first-party script. Tests, docs, packaging and the public offline evidence artifact are updated to match (fixture results unchanged). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QRXYjdLRbDr9oEUU4qdZ2m
Without ENGRAPHIS_API_TOKEN the dashboard trusts loopback peers. A website that points its own name at 127.0.0.1 (DNS rebinding) becomes same-origin with that name, so its requests came from a loopback peer, passed every Origin check and could read or write the whole /api surface. - The zero-config gate now also checks Host: it accepts exactly `localhost`, IP literals (an address cannot be rebound), the bind host, the ENGRAPHIS_DASHBOARD_URL host and the new ENGRAPHIS_ALLOWED_HOSTS names. `localhost.` and `*.localhost` are refused because some resolvers send them to DNS. Token mode is unchanged. - The check covers the `/dashboard/review` routes as well as `/api`; `/mcp` keeps the SDK's own Host allow-list. - The read-only graph server (engraphis-graph-server) applies the same check when it runs without a token. - The cross-site guard no longer lets a header vouch for another site's page: with ENGRAPHIS_CORS_ORIGINS=* any page could pass the preflight and send the dashboard's header. - Ledger shows the server's reason when a request is refused instead of reporting the server as unreachable. The helpers live in engraphis/netutil.py and are unit-tested; the public offline evidence artifact is re-exported for the new sources (fixture results unchanged). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QRXYjdLRbDr9oEUU4qdZ2m
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 679dcbb1f9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 22ce45e0da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a1af2b2224
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1f85a4925
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de8c168b95
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 606d3e579b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95999cb42e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f07db1ff95
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
# Conflicts: # package.json
* fix(deps-dev): bump openai-codex from 0.159.0 to 0.160.1 --- updated-dependencies: - dependency-name: openai-codex dependency-version: 0.160.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * fix: address verified release audit findings Validated local candidate: f9dabd9d69d779210ce83e919b410b1770505e43 - f9dabd9d69d779210ce83e919b410b1770505e43 fix(packaging): align MCP install paths with the patched SDK floor - 24afc26e882c0f3fa5eab4b6e2b5294fe73bd4c6 fix(deps): require the patched MCP 1.30 transport --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
…258) * fix(deps-dev): bump tree-sitter-language-pack from 1.20.0 to 1.21.0 Bumps [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) from 1.20.0 to 1.21.0. - [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases) - [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md) - [Commits](xberg-io/tree-sitter-language-pack@v1.20.0...v1.21.0) --- updated-dependencies: - dependency-name: tree-sitter-language-pack dependency-version: 1.21.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Keep new benchmark campaigns on the updated tree-sitter grammars * fix: address verified release audit findings Validated local candidate: e142e3158e06c92c00253266120496d33d111a92 - e142e3158e06c92c00253266120496d33d111a92 fix(packaging): align MCP install paths with the patched SDK floor - e5631206443c0d069d3e9114bccb87111b89d602 fix(deps): require the patched MCP 1.30 transport --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
* fix(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.24.2 to 0.24.3. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@3ad7283...66cbf4b) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.24.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * test(release): validate immutable SBOM action pins across upgrades * fix: address verified release audit findings Validated local candidate: 0e9f6f2599167a5f235b298d39c87182356156f5 - 0e9f6f2599167a5f235b298d39c87182356156f5 fix(packaging): align MCP install paths with the patched SDK floor - 3207cfa5af1c7309407b8d63f9ca304113dfcd66 fix(deps): require the patched MCP 1.30 transport --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Coding-Dev-Tools <algorithmictradingsolutions@gmail.com>
….22,<0.18 (#264) * fix(deps-dev): update ruff requirement Updates the requirements on [ruff](https://github.com/astral-sh/ruff) to permit the latest version. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.17.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.17.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * test(release): align ruff version bound assertion with <0.18 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
Bumps [@playwright/test](https://github.com/microsoft/playwright) from 1.63.0 to 1.64.0. - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.0) --- updated-dependencies: - dependency-name: "@playwright/test" dependency-version: 1.64.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-action ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.1 to 8.0.2. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [impeccable](https://github.com/pbakaus/impeccable) from 4.1.0 to 4.5.2. - [Release notes](https://github.com/pbakaus/impeccable/releases) - [Changelog](https://github.com/pbakaus/impeccable/blob/main/docs/RELEASE-4.4.0.md) - [Commits](pbakaus/impeccable@cli-v4.1.0...cli-v4.5.2) --- updated-dependencies: - dependency-name: impeccable dependency-version: 4.5.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jaixii <algorithmictradingsolutions@gmail.com>
…engraphis-final-stack-20261017
…engraphis-final-stack-20261017
fa692a5
into
codex/dashboard-local-audit-20261011
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa692a5a62
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Consolidates Classic capabilities into Ledger, redirects /classic, protects hidden drafts across refreshes and workspace changes, and enforces complete browser origins for token-free local APIs. Timeline filtering precedes limits and follows world/system time. This PR follows #261 and includes the verified #260/#261 fixes.
Community legend names and colors now remain stable when filtering changes their visible rank. Relation pagination focuses the first newly revealed row, including the final partial page. Existing draft, scope, temporal, CSP and origin review safeguards remain covered.
Validation: 95 focused graph, polling, spec API, evidence, MCP and skill tests; 13 documentation/distribution tests; the new relation-pagination Chromium regression; Ruff. Fresh immutable evidence, SVG/PNG provenance and README source links match this branch. Remote CI validates the complete matrix at the pushed head.