diff --git a/packages/libclaudebox/config.ts b/packages/libclaudebox/config.ts index 8f93441..c7463e9 100644 --- a/packages/libclaudebox/config.ts +++ b/packages/libclaudebox/config.ts @@ -25,7 +25,7 @@ export const BASTION_SSH_KEY = join(homedir(), ".ssh", "build_instance_key"); // ── Interactive session config ────────────────────────────────── export const CLAUDEBOX_HOST = process.env.CLAUDEBOX_HOST || "localhost:3000"; -export const SESSION_PAGE_USER = process.env.CLAUDEBOX_SESSION_USER || "admin"; +export const SESSION_PAGE_USER = process.env.CLAUDEBOX_SESSION_USER || "aztec"; export const SESSION_PAGE_PASS = process.env.CLAUDEBOX_SESSION_PASS || ""; // ── Log URL builder ───────────────────────────────────────────── diff --git a/packages/libclaudebox/docker.ts b/packages/libclaudebox/docker.ts index edbe764..42e0e73 100644 --- a/packages/libclaudebox/docker.ts +++ b/packages/libclaudebox/docker.ts @@ -147,8 +147,6 @@ export class DockerService { const profile = await loadProfile(profileDir); const dockerConfig = profile.docker || {}; const containerImage = dockerConfig.image || DOCKER_IMAGE; - const mountRef = dockerConfig.mountReferenceRepo !== false; // default true - console.log(`[DOCKER] Starting session ${logId} (worktree=${worktreeId} profile=${profileDir})`); console.log(`[DOCKER] Sidecar: ${sidecarName}`); console.log(`[DOCKER] Claude: ${claudeName}`); @@ -218,13 +216,11 @@ export class DockerService { `${claudeProjectsDir}:${CONTAINER_HOME}/.claude/projects/-workspace:ro`, `${CLAUDEBOX_CODE_DIR}:/opt/claudebox:ro`, `${profileHostDir}:/opt/claudebox-profile:rw`, - `${BASTION_SSH_KEY}:${CONTAINER_HOME}/.ssh/build_instance_key:ro`, + `${BASTION_SSH_KEY}:/home/aztec-dev/.ssh/build_instance_key:ro`, `${CLAUDEBOX_STATS_DIR}:/stats:rw`, `${CLAUDEBOX_DIR}:${CONTAINER_HOME}/.claudebox:rw`, ]; - if (mountRef) { - sidecarBinds.push(`${join(REPO_DIR, ".git")}:/reference-repo/.git:ro`); - } + sidecarBinds.push(`${join(REPO_DIR, ".git")}:/reference-repo/.git:ro`); // Server URL for sidecar → server communication (internal port, not exposed to internet) const serverUrl = `http://host.docker.internal:${INTERNAL_PORT}`; @@ -301,7 +297,6 @@ export class DockerService { "-v", `${join(CLAUDEBOX_CODE_DIR, "profiles", profileDir)}:/opt/claudebox-profile:rw`, "-e", `CLAUDEBOX_MCP_URL=${mcpUrl}`, "-e", `SESSION_UUID=${sessionUuid}`, - "-e", `AZTEC_MCP_SERVER=http://${sidecarName}:9801/creds`, "-e", `CLAUDEBOX_SIDECAR_HOST=${sidecarName}`, "-e", `CLAUDEBOX_SIDECAR_PORT=9801`, "-e", `PARENT_LOG_ID=${logId}`, @@ -318,10 +313,8 @@ export class DockerService { if (dockerConfig.extraBinds) { for (const b of dockerConfig.extraBinds) claudeArgs.push("-v", b); } - // Mount reference repo for profiles that use local clone - if (mountRef) { - claudeArgs.push("-v", `${join(REPO_DIR, ".git")}:/reference-repo/.git:ro`); - } + // Mount reference repo for sparse pre-clone + claudeArgs.push("-v", `${join(REPO_DIR, ".git")}:/reference-repo/.git:ro`); // Auto-detect resume if (opts.worktreeId) { diff --git a/packages/libclaudebox/html/workspace.ts b/packages/libclaudebox/html/workspace.ts index 71a0469..6388c30 100644 --- a/packages/libclaudebox/html/workspace.ts +++ b/packages/libclaudebox/html/workspace.ts @@ -525,6 +525,13 @@ function PromptCard({text, time, user, slackLink}){ // ── Artifact helpers ───────────────────────────────────────────── +// Deduplicate artifacts by URL (or full text if no URL), keeping last occurrence +function dedupArtifacts(artifacts){ + var seen=new Map(); + for(var a of artifacts){var t=slackToMd(a.text);var u=t.match(/https?:\\/\\/\\S+/);seen.set(u?u[0]:t,a);} + return[...seen.values()]; +} + // Extract PR number from artifact text function artifactPrNum(text){ var m=text.match(/#(\\d+)/); @@ -534,7 +541,8 @@ function artifactPrNum(text){ // Build compact artifact chips for a run, marking PR updates function ArtifactChips({artifacts, priorPrNums}){ if(!artifacts||!artifacts.length)return null; - return html\`
\${artifacts.map((a,i)=>{ + var unique=dedupArtifacts(artifacts); + return html\`
\${unique.map((a,i)=>{ var text=slackToMd(a.text); var prNum=artifactPrNum(text); var isUpdate=(prNum&&priorPrNums&&priorPrNums.has(prNum))||/updated/i.test(text); @@ -544,20 +552,33 @@ function ArtifactChips({artifacts, priorPrNums}){ } // ── AgentSection — collapsible agent card ───────────────────── -function AgentSection({text, agentLogUrl, time, children}){ - const [expanded,setExpanded]=useState(false); +function AgentSection({text, agentId, time, children}){ + const PREVIEW=6; + const [expanded,setExpanded]=useState(()=>window.location.hash==="#agent-"+agentId); + const [showAll,setShowAll]=useState(false); + const total=children?children.length:0; + const visible=showAll||total<=PREVIEW?children:(children||[]).slice(0,PREVIEW); const linked=linkify(slackToMd(text)); - const agentInner=agentLogUrl - ?''+linked+'' - :linked; - return html\`
-
setExpanded(!expanded)}> + const ref=useRef(null); + useEffect(()=>{if(expanded&&ref.current&&window.location.hash==="#agent-"+agentId)ref.current.scrollIntoView({block:"start"});},[]); + function toggle(){ + const next=!expanded; + setExpanded(next); + if(next){history.replaceState(null,"","#agent-"+agentId);} + else{history.replaceState(null,"",window.location.pathname+window.location.search);} + } + return html\`
+
\u25B6 - + + \${total?html\`(\${total})\`:null} \${time}
- \${children&&children.length?html\`
\${children}
\`:null} + \${expanded&&visible&&visible.length?html\`
+ \${visible} + \${!showAll&&total>PREVIEW?html\`
{e.stopPropagation();setShowAll(true);}}>show all \${total} entries
\`:null} +
\`:null}
\`; } @@ -568,22 +589,23 @@ function renderActivityItems(activity){ var item=activity[i]; var entry=item.entry; var key=item.id||("a"+i); - // Agent sections — collect subsequent tool calls until next non-tool entry + // Agent sections — collect subsequent tool/subagent entries if(entry.type==="agent_start"){ var agentChildren=[]; var j=i+1; while(j\${grouped}\`); - i=j-1; // skip grouped items + var agentId=key.replace(/[^a-z0-9-]/gi,""); + out.push(html\`<\${AgentSection} key=\${key} text=\${entry.text||""} agentId=\${agentId} time=\${entry.ts?timeAgo(entry.ts):""}>\${grouped}\`); + i=j-1; continue; } if(entry.type==="tool_use"){ @@ -778,12 +800,10 @@ function Sidebar({open, status, exitCode, user, baseBranch, sessions, artifacts, \${sessions.length&&sessions[0].started?html\`
started \${timeAgo(sessions[0].started)}
\`:null}
\${artifacts.length?html\`
-
Artifacts (\${artifacts.length})
+ \${(()=>{var u=dedupArtifacts(artifacts);return html\`
Artifacts (\${u.length})
- \${artifacts.map((a,i)=>{ - return html\`\`; - })} -
+ \${u.map((a,i)=>html\`\`)} +
\`;})()}
\`:null} \${sessions.length>1?html\`
Runs
@@ -912,6 +932,17 @@ function WorkspacePage(){ const goBack=useCallback(()=>{setSelectedRun(null);},[]); + // Sync URL with selected run + useEffect(()=>{ + const url=new URL(window.location); + if(selectedRun!=null&&runs[selectedRun]){ + url.searchParams.set("run",runs[selectedRun].logId); + }else{ + url.searchParams.delete("run"); + } + if(url.href!==window.location.href)history.replaceState(null,"",url); + },[selectedRun,runs]); + // Auto-open detail when new session starts on a running workspace const runsLen=runs.length; useEffect(()=>{ @@ -1014,6 +1045,10 @@ function WorkspacePage(){ if(!newLogId)return; var newSession={log_id:newLogId,status:"running",started:new Date().toISOString(),user:D.user,prompt:text,slack_channel:"",slack_message_ts:"",slack_thread_ts:""}; D.sessions.unshift(newSession); + // Clear activity/artifacts for the new run so previous run's entries don't bleed in + setActivityByRun(prev=>({...prev,[newLogId]:[]})); + setArtifactsByRun(prev=>({...prev,[newLogId]:[]})); + setLastReplyByRun(prev=>{const next={...prev};delete next[newLogId];return next;}); var newIdx; setRuns(prev=>{ var total=prev.length+1; @@ -1054,7 +1089,23 @@ function WorkspacePage(){ const wasRunning=statusRef.current==="running"; setStatus(d.status); setExitCode(d.exit_code); - if(wasRunning&&d.status!=="running")setTimeout(()=>sendNextQueued(),100); + // Update last run's status so RunCard/RunDetail reflect it + setRuns(prev=>{if(!prev.length)return prev;const copy=[...prev];copy[copy.length-1]={...copy[copy.length-1],status:d.status,exitCode:d.exit_code};return copy;}); + // Inject activity entry for terminal states + if(wasRunning&&d.status!=="running"){ + setRuns(prev=>{ + if(!prev.length)return prev; + const lastLogId=prev[prev.length-1].logId; + const entry={type:"status",text:"Session "+d.status+(d.exit_code!=null?" (exit "+d.exit_code+")":""),ts:new Date().toISOString()}; + const mid=msgId(entry.text); + if(!seenRef.current.has(mid)){ + seenRef.current.add(mid); + setActivityByRun(ap=>{const n={...ap};n[lastLogId]=[...(n[lastLogId]||[]),{entry,id:mid}];return n;}); + } + return prev; + }); + setTimeout(()=>sendNextQueued(),100); + } }else if(d.type==="init"){ if(Array.isArray(d.activity)){ const results=[]; diff --git a/packages/libclaudebox/http-routes.ts b/packages/libclaudebox/http-routes.ts index 9099252..ad84e3b 100644 --- a/packages/libclaudebox/http-routes.ts +++ b/packages/libclaudebox/http-routes.ts @@ -525,14 +525,14 @@ const routes: Route[] = [ const sessions = worktreeId ? store.listByWorktree(worktreeId) : [{ ...session, _log_id: hash }]; const worktreeAlive = worktreeId ? store.isWorktreeAlive(worktreeId) : false; - // Extract last reply per session from activity (for collapsed card summaries) + // Extract all replies per session from activity (for run card summaries) const lastReplies: Record = {}; if (worktreeId) { const activity = store.readActivity(worktreeId); // newest first const sessionsOldest = [...sessions].reverse(); + const repliesByRun: Record = {}; for (const entry of activity) { if (entry.type !== "response") continue; - // Find which session this entry belongs to by timestamp let logId: string | undefined; if ((entry as any).log_id) { logId = (entry as any).log_id; @@ -544,7 +544,14 @@ const routes: Route[] = [ } } } - if (logId && !lastReplies[logId]) lastReplies[logId] = entry.text; + if (logId) { + if (!repliesByRun[logId]) repliesByRun[logId] = []; + repliesByRun[logId].push(entry.text); + } + } + // Combine all replies (reversed to chronological order) + for (const [logId, replies] of Object.entries(repliesByRun)) { + lastReplies[logId] = replies.reverse().join("\n\n---\n\n"); } } @@ -1412,6 +1419,36 @@ const routes: Route[] = [ } }, }, + + // ── Internal API: CI log read (sidecar → host, host has Redis/SSH) ── + { + method: "GET", pattern: /^\/api\/internal\/read-log$/, auth: "api", internal: true, + handler: async (req, res) => { + const url = new URL(req.url!, `http://${req.headers.host}`); + const key = url.searchParams.get("key") || ""; + if (!key || !/^[a-zA-Z0-9._-]+$/.test(key)) { json(res, 400, { error: "invalid key" }); return; } + + try { + const { spawnSync } = await import("child_process"); + const { join } = await import("path"); + const repoDir = process.env.CLAUDE_REPO_DIR || join(process.env.HOME || "", "repo"); + const ciSh = join(repoDir, "ci.sh"); + const result = spawnSync("bash", ["-c", `cd "${repoDir}" && "${ciSh}" dlog "${key}"`], { + encoding: "utf-8", timeout: 30_000, stdio: ["pipe", "pipe", "pipe"], + }); + if (result.status !== 0) { + json(res, 502, { error: (result.stderr || "").trim().slice(0, 500) }); + return; + } + // Strip ci.sh startup noise (Slack listener, PID lines) + let output = (result.stdout || "").replace(/^(?:Starting Slack listener\.\.\.\n|Started \(PID \d+\)\n)*/m, ""); + res.writeHead(200, { "Content-Type": "text/plain" }); + res.end(output); + } catch (e: any) { + json(res, 500, { error: e.message }); + } + }, + }, ]; // ── Server factory ────────────────────────────────────────────── diff --git a/packages/libclaudebox/mcp/git-tools.ts b/packages/libclaudebox/mcp/git-tools.ts index 4eb45c3..3062dd7 100644 --- a/packages/libclaudebox/mcp/git-tools.ts +++ b/packages/libclaudebox/mcp/git-tools.ts @@ -126,11 +126,12 @@ export interface PRToolConfig { export function registerCloneRepo(server: McpServer, config: CloneToolConfig): void { const desc = config.description || - `Clone the repo into ${config.workspace}. Safe to call on resume — fetches new refs. Call FIRST before doing any work.`; + `Clone the repo into ${config.workspace}. MUST be your FIRST tool call — the workspace is empty until you clone. Do NOT run git, ls, Read, or any file operations before calling this. Safe to call on resume — fetches new refs.`; const refHint = config.refHint || "'origin/next', 'abc123'"; + const defaultRef = config.fallbackRef || "origin/main"; server.tool("clone_repo", desc, - { ref: z.string().regex(/^[a-zA-Z0-9._\/@-]+$/).describe(`Branch, tag, or commit hash to check out (e.g. ${refHint})`) }, + { ref: z.string().regex(/^[a-zA-Z0-9._\/@-]+$/).default(defaultRef).describe(`Branch, tag, or commit hash to check out (default: ${defaultRef}). Examples: ${refHint}`) }, async ({ ref }) => { if (ref.startsWith("-")) return { content: [{ type: "text", text: "Invalid ref: must not start with -" }], isError: true }; const targetDir = config.workspace; @@ -274,57 +275,42 @@ export function registerLogTools(server: McpServer, config: { workspace: string } server.tool("read_log", - `Read a CI log by key/hash. Use this to view build logs, session logs, or any ci.aztec-labs.com log. - -IMPORTANT: Use this tool instead of: -- Curling ci.aztec-labs.com directly (will fail — no CI_PASSWORD in container) -- Using CI_PASSWORD env var (not available) -- Running ci.sh dlog manually - -Pass the log key (hex hash from the URL). Returns the log content.`, + `Read a CI log by key/hash. Use instead of curling ci.aztec-labs.com or using CI_PASSWORD.`, { - key: z.string().regex(/^[a-zA-Z0-9._-]+$/).describe("Log key/hash (the hex string from a ci.aztec-labs.com URL)"), - tail: z.number().optional().describe("Only return the last N lines (useful for large logs)"), + key: z.string().regex(/^[a-zA-Z0-9._-]+$/).describe("Log key/hash from a ci.aztec-labs.com URL"), + tail: z.number().optional().describe("Only return the last N lines"), head: z.number().optional().describe("Only return the first N lines"), }, async ({ key, tail, head }) => { - const ci3 = findCi3(); - if (!ci3) { - return { content: [{ type: "text", text: "ci3/ not found. Run clone_repo first to make log tools available." }], isError: true }; + const serverUrl = process.env.CLAUDEBOX_SERVER_URL; + const serverToken = process.env.CLAUDEBOX_SERVER_TOKEN; + if (!serverUrl || !serverToken) { + return { content: [{ type: "text", text: "read_log: no server connection configured" }], isError: true }; } try { - // ci.sh dlog sources Redis connection scripts and reads the key - const ciSh = join(config.workspace, "ci.sh"); - const cmd = existsSync(ciSh) ? ciSh : join(ci3, "..", "ci.sh"); - const result = spawnSync("bash", ["-c", `cd "${config.workspace}" && "${cmd}" dlog "${key}"`], { - encoding: "utf-8", - timeout: 30_000, - stdio: ["pipe", "pipe", "pipe"], - env: { ...process.env }, + const resp = await fetch(`${serverUrl}/api/internal/read-log?key=${encodeURIComponent(key)}`, { + headers: { "Authorization": `Bearer ${serverToken}` }, }); - - if (result.status !== 0) { - const err = (result.stderr || "").trim(); - return { content: [{ type: "text", text: `read_log failed (exit ${result.status}): ${err.slice(0, 500)}` }], isError: true }; + if (!resp.ok) { + const err = await resp.text(); + return { content: [{ type: "text", text: `read_log failed: ${err.slice(0, 500)}` }], isError: true }; } - let output = result.stdout || ""; + let output = await resp.text(); if (!output.trim()) { return { content: [{ type: "text", text: `Log '${key}' is empty or not found.` }], isError: true }; } - // Apply head/tail filtering if (tail || head) { const lines = output.split("\n"); if (tail) output = lines.slice(-tail).join("\n"); else if (head) output = lines.slice(0, head).join("\n"); } - // Truncate very large output const MAX = 200_000; if (output.length > MAX) { - output = output.slice(0, MAX) + `\n\n...(truncated at ${MAX} chars, use tail/head params to paginate)`; + output = output.slice(0, MAX) + `\n\n...(truncated at ${MAX} chars, use tail/head params)`; } return { content: [{ type: "text", text: output }] }; diff --git a/packages/libclaudebox/profile.ts b/packages/libclaudebox/profile.ts index 6d7129a..6288bf6 100644 --- a/packages/libclaudebox/profile.ts +++ b/packages/libclaudebox/profile.ts @@ -16,8 +16,6 @@ import type { RunMeta, ContainerSessionOpts } from "./types.ts"; export interface DockerConfig { /** Docker image to use (overrides global default) */ image?: string; - /** Mount the local .git as reference repo (default: true) */ - mountReferenceRepo?: boolean; /** Extra bind mounts: ["host:container:mode", ...] */ extraBinds?: string[]; /** Extra env vars: ["KEY=value", ...] */ diff --git a/packages/libclaudebox/session-streamer.ts b/packages/libclaudebox/session-streamer.ts index e3cb384..124957d 100644 --- a/packages/libclaudebox/session-streamer.ts +++ b/packages/libclaudebox/session-streamer.ts @@ -35,6 +35,7 @@ interface ActivityEvent { type: string; text: string; log_id?: string; + subagent?: boolean; } // ── Helpers ───────────────────────────────────────────────────── @@ -96,9 +97,10 @@ export class SessionStreamer { this.denoiseScript = join(opts.repoDir, "ci3", "denoise"); } - private writeActivity(type: string, text: string): void { + private writeActivity(type: string, text: string, isSubagent = false): void { try { const event: ActivityEvent = { ts: new Date().toISOString(), type, text, log_id: this.opts.parentLogId }; + if (isSubagent) event.subagent = true; appendFileSync(this.opts.activityLog, JSON.stringify(event) + "\n"); } catch {} } @@ -144,6 +146,8 @@ export class SessionStreamer { const inp = item.input ?? {}; const desc = inp.description ?? inp.command ?? inp.file_path ?? inp.pattern ?? ""; this.emit(` subagent ${name} ${trunc(desc, 120)}`); + // Write subagent tool activity — tagged so UI nests it inside AgentSection + this.writeToolActivity(name, inp, true); } } } @@ -174,8 +178,8 @@ export class SessionStreamer { const disp = this.smartTrunc(res, "tool-result"); this.emit(` ${label}: ${disp}`); // Write tool results to activity for MCP tools (get_context etc.) - if (!isSubagent && res.trim()) { - this.writeActivity("tool_result", trunc(res, 600)); + if (res.trim()) { + this.writeActivity("tool_result", trunc(res, 600), isSubagent); } } else if (item.type === "text" && item.text?.trim()) { this.emit(`USER: ${this.smartTrunc(item.text, "user-msg")}`); @@ -210,9 +214,7 @@ export class SessionStreamer { const inp = item.input ?? {}; // Write activity event for the status page - if (!isSubagent) { - this.writeToolActivity(name, inp); - } + this.writeToolActivity(name, inp, isSubagent); // Pretty-print for cache log this.emitToolUse(name, inp); @@ -239,37 +241,37 @@ export class SessionStreamer { } } - private writeToolActivity(name: string, inp: any): void { + private writeToolActivity(name: string, inp: any, isSubagent = false): void { + const w = (type: string, text: string) => this.writeActivity(type, text, isSubagent); if (name === "Agent" && inp.description) { - this.writeActivity("agent_start", inp.description); + w("agent_start", inp.description); } else if (name === "Bash" && inp.command) { const desc = inp.description ? `${inp.description}: ` : ""; const cmd = inp.command.length > 120 ? inp.command.slice(0, 120) + "…" : inp.command; - this.writeActivity("tool_use", `${desc}$ ${cmd}`); + w("tool_use", `${desc}$ ${cmd}`); } else if (name === "Grep") { const path = inp.path || inp.file_path || ""; - this.writeActivity("tool_use", `Grep ${trunc(inp.pattern || "", 60)} ${path}`); + w("tool_use", `Grep ${trunc(inp.pattern || "", 60)} ${path}`); } else if (["Read", "Glob"].includes(name)) { const target = inp.file_path || inp.pattern || inp.path || ""; - this.writeActivity("tool_use", `${name} ${trunc(target, 80)}`); + w("tool_use", `${name} ${trunc(target, 80)}`); } else if (["Edit", "Write"].includes(name)) { - this.writeActivity("tool_use", `${name} ${inp.file_path || ""}`); + w("tool_use", `${name} ${inp.file_path || ""}`); } else if (name === "ToolSearch") { - this.writeActivity("tool_use", `ToolSearch ${inp.query || ""}`); + w("tool_use", `ToolSearch ${inp.query || ""}`); } else if (name.startsWith("mcp__claudebox__")) { const short = name.replace("mcp__claudebox__", ""); const args = Object.entries(inp).filter(([_, v]) => v !== undefined && v !== "").map(([k, v]) => { const s = String(v); return `${k}=${s.length > 60 ? s.slice(0, 60) + "…" : s}`; }).join(" "); - this.writeActivity("tool_use", `${short}${args ? " " + args : ""}`); + w("tool_use", `${short}${args ? " " + args : ""}`); } else if (!["mcp__ide__getDiagnostics", "mcp__ide__executeCode", "TaskCreate", "TaskUpdate", "TaskList", "TaskGet"].includes(name)) { - // Generic: show tool name + compact args const args = Object.entries(inp).filter(([_, v]) => v !== undefined && v !== "").slice(0, 3).map(([k, v]) => { const s = typeof v === "object" ? JSON.stringify(v) : String(v); return `${k}=${s.length > 40 ? s.slice(0, 40) + "…" : s}`; }).join(" "); - this.writeActivity("tool_use", `${name}${args ? " " + args : ""}`); + w("tool_use", `${name}${args ? " " + args : ""}`); } } diff --git a/profiles/barretenberg-audit/CLAUDE.md b/profiles/barretenberg-audit/CLAUDE.md index 7adb2eb..d7fef1a 100644 --- a/profiles/barretenberg-audit/CLAUDE.md +++ b/profiles/barretenberg-audit/CLAUDE.md @@ -1,6 +1,8 @@ You are ClaudeBox (Audit Mode), an automated security auditor in a Docker container. You have no interactive user — work autonomously. +**YOUR VERY FIRST ACTION must be `clone_repo`.** The workspace is EMPTY — no repo, no files, no git. Every other tool will fail until you clone. Do not run Bash, Read, Glob, Grep, git, or ls first. Call `clone_repo` immediately. + ## Scope You are auditing `barretenberg-claude`, a private fork of the barretenberg cryptography library. @@ -29,9 +31,17 @@ The repo has skills that define rigorous audit processes. **You MUST use them.** The skills load PRINCIPLES.md (known bug classes) and CRITERIA.md (code quality patterns) from the repo. They guide systematic file-by-file review with validation steps. Do NOT skip them and audit manually. +## Branches + +- **`origin/next`** — default branch, aligned with upstream. Has phase 0 audit workflows. +- **`origin/claude-audit-phase0`** — archive of 79 commits of prior audit work: Lean4 formal proofs (Sumcheck, Gemini, ECCVM, UltraHonk, field arithmetic, Solidity verifier), audit skills, C++ findings (P1–P21), meta-issue tracking. + +If your task references phase0, Lean4 proofs, or continuing prior audit work, clone at `origin/claude-audit-phase0`. + ## Environment -- **Working directory**: `/workspace` — use `clone_repo` to set up the repo +- **Working directory**: `/workspace` — **empty until you call `clone_repo`** +- **CRITICAL**: `clone_repo` MUST be your first tool call. Do NOT run git, ls, cat, Read, Glob, Grep, or any file operations before cloning. The workspace has no repo until you clone it. - After cloning, the repo is at `/workspace/barretenberg-claude` - This is a **private** repo — authentication is handled by the MCP sidecar - No Docker access — focus on code review, not running builds @@ -43,7 +53,7 @@ The skills load PRINCIPLES.md (known bug classes) and CRITERIA.md (code quality | Tool | Purpose | |------|---------| -| `clone_repo` | **FIRST** — clone/update the repo at a given ref | +| `clone_repo` | **MUST be your FIRST call** — workspace is empty until you clone | | `set_workspace_name` | Call right after cloning — give this workspace a short descriptive slug. | | `respond_to_user` | **REQUIRED** — send your final response | | `get_context` | Session metadata | @@ -84,7 +94,7 @@ create_issue( ``` ### Workflow: -1. `clone_repo` — check out the target ref +1. `clone_repo` — **FIRST** — check out the target ref (nothing works without this) 2. `get_context` — get session metadata 3. `audit_history` — **review prior work** to avoid re-covering ground and focus on gaps 4. `session_status` — report progress frequently @@ -100,10 +110,10 @@ create_issue( ### Final response — `respond_to_user` (REQUIRED) -Keep it to 1-2 SHORT sentences. Print verbose output to stdout and reference the log. +Keep it to 1-2 SHORT sentences. **Never send long explanations** — put details in a gist and link it. -- Good: "Reviewed polynomial commitment code. Filed 3 issues — 1 high severity (buffer overflow in evaluator), 2 medium. " -- Good: "No critical findings in field arithmetic. 12 files reviewed line-by-line. " +- Good: "Reviewed polynomial commitment code. Filed 3 issues — 1 high severity. " +- Bad: Multi-paragraph explanations (put these in a gist instead) Use `audit-finding` label on `create_issue` for findings. diff --git a/profiles/barretenberg-audit/mcp-sidecar.ts b/profiles/barretenberg-audit/mcp-sidecar.ts index 5edb9bd..62b1673 100755 --- a/profiles/barretenberg-audit/mcp-sidecar.ts +++ b/profiles/barretenberg-audit/mcp-sidecar.ts @@ -48,14 +48,14 @@ function createServer(): McpServer { registerCloneRepo(server, { repo: REPO, workspace: WORKSPACE, strategy: "authenticated-url", - fallbackRef: "origin/master", - refHint: "'origin/main', 'abc123'", - description: "Clone the barretenberg-claude repo (private). Uses authenticated URL. Safe to call on resume — fetches new refs. Call FIRST before doing any work.", + fallbackRef: "origin/next", + refHint: "'origin/next' (default branch), 'origin/claude-audit-phase0', 'abc123'", + description: "Clone the barretenberg-claude repo (private). Uses authenticated URL. Safe to call on resume — fetches new refs. Call FIRST before doing any work. Default branch is 'next' — use ref='origin/next' unless told otherwise.", }); registerPRTools(server, { repo: REPO, workspace: WORKSPACE, - branchPrefix: "audit/", defaultBase: "master", + branchPrefix: "audit/", defaultBase: "next", }); // ── Helpers ───────────────────────────────────────────────────── @@ -228,33 +228,17 @@ Use this when you discover a new area worth dedicated audit attention.`, } }); - // ── add_log_link — cross-reference session on an issue ────────── + // ── add_log_link — track cross-reference locally (no GitHub comment) ── server.tool("add_log_link", - "Add a cross-reference comment to an issue linking it to the current session's log. Use this to build an audit trail connecting issues to the sessions that investigated them.", + "Record a cross-reference between an issue and the current session. Tracked locally in activity log — does NOT post a comment on the issue.", { issue_number: z.number().describe("Issue number to link"), context: z.string().describe("What this session did related to this issue (1-2 sentences)"), }, async ({ issue_number, context }) => { - try { - const body = [ - `**Session cross-reference**`, - ``, - context, - ``, - `- Log: ${SESSION_META.log_url || "n/a"}`, - `- Status: ${statusPageUrl || "n/a"}`, - `- Session: \`${SESSION_META.log_id || WORKTREE_ID}\``, - ].join("\n"); - - await getCreds().github.addIssueComment(REPO, issue_number, body); - - logActivity("artifact", `Cross-ref #${issue_number}: ${context}`); - await updateRootComment(); - return { content: [{ type: "text", text: `Linked session to #${issue_number}` }] }; - } catch (e: any) { - return { content: [{ type: "text", text: `add_log_link: ${sanitizeError(e.message)}` }], isError: true }; - } + logActivity("artifact", `Cross-ref #${issue_number}: ${context}`); + await updateRootComment(); + return { content: [{ type: "text", text: `Linked session to #${issue_number} (local tracking only)` }] }; }); // ── audit_history — read prior audit stats for continuity ─────── diff --git a/profiles/barretenberg-audit/plugin.ts b/profiles/barretenberg-audit/plugin.ts index e6e12d3..012cd10 100644 --- a/profiles/barretenberg-audit/plugin.ts +++ b/profiles/barretenberg-audit/plugin.ts @@ -18,7 +18,6 @@ const plugin: Profile = { name: "barretenberg-audit", docker: { - mountReferenceRepo: false, extraEnv: ["CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1"], }, diff --git a/profiles/claudebox-dev/CLAUDE.md b/profiles/claudebox-dev/CLAUDE.md index bb01deb..0029689 100644 --- a/profiles/claudebox-dev/CLAUDE.md +++ b/profiles/claudebox-dev/CLAUDE.md @@ -1,6 +1,8 @@ You are ClaudeBox (Dev Mode), an automated assistant working on ClaudeBox infrastructure itself. You have no interactive user — work autonomously. +**YOUR VERY FIRST ACTION must be `clone_repo`.** The workspace is EMPTY — no repo, no files, no git. Every other tool will fail until you clone. Do not run Bash, Read, Glob, Grep, git, or ls first. Call `clone_repo` immediately. + ## Scope You are working on the ClaudeBox platform — the Slack bot, MCP sidecars, Docker orchestration, and web dashboard. @@ -22,7 +24,8 @@ Key directories: ## Environment -- **Working directory**: `/workspace` — use `clone_repo` to set up the repo +- **Working directory**: `/workspace` — **empty until you call `clone_repo`** +- **CRITICAL**: `clone_repo` MUST be your first tool call. Do NOT run git, ls, Read, or any file operations before cloning. - After cloning, the repo is at `/workspace/claudebox` - Full internet access for packages, builds, etc. - Use `/tmp` for scratch files @@ -33,7 +36,7 @@ Key directories: | Tool | Purpose | |------|---------| -| `clone_repo` | **FIRST** — clone/update the repo at a given ref | +| `clone_repo` | **MUST be your FIRST call** — workspace is empty until you clone | | `set_workspace_name` | Call right after cloning — give this workspace a short descriptive slug. | | `respond_to_user` | **REQUIRED** — send your final response | | `get_context` | Session metadata | diff --git a/profiles/claudebox-dev/plugin.ts b/profiles/claudebox-dev/plugin.ts index ce93338..3074e26 100644 --- a/profiles/claudebox-dev/plugin.ts +++ b/profiles/claudebox-dev/plugin.ts @@ -2,7 +2,7 @@ import type { Profile } from "../../packages/libclaudebox/profile.ts"; const plugin: Profile = { name: "claudebox-dev", - docker: { mountReferenceRepo: false }, + docker: {}, setup(_ctx) {}, }; diff --git a/profiles/minimal/plugin.ts b/profiles/minimal/plugin.ts index ca555b9..4b3ab1f 100644 --- a/profiles/minimal/plugin.ts +++ b/profiles/minimal/plugin.ts @@ -2,7 +2,7 @@ import type { Profile } from "../../packages/libclaudebox/profile.ts"; const plugin: Profile = { name: "minimal", - docker: { mountReferenceRepo: false }, + docker: {}, setup(_ctx) {}, }; diff --git a/server.ts b/server.ts index bf29ffd..c340f52 100755 --- a/server.ts +++ b/server.ts @@ -153,8 +153,8 @@ async function main() { console.log(` HTTP (public) listening on :${HTTP_PORT}`); }); - internalServer.listen(INTERNAL_PORT, "127.0.0.1", () => { - console.log(` HTTP (internal) listening on 127.0.0.1:${INTERNAL_PORT}`); + internalServer.listen(INTERNAL_PORT, () => { + console.log(` HTTP (internal) listening on :${INTERNAL_PORT}`); }); // ── Auto-update (polls origin/next, restarts on new commits) ── diff --git a/tests/setup.ts b/tests/setup.ts index a161fae..7183cf5 100644 --- a/tests/setup.ts +++ b/tests/setup.ts @@ -4,4 +4,4 @@ process.env.CLAUDEBOX_SESSION_PASS = "test-pass"; process.env.CLAUDEBOX_HOST = "claudebox.test"; process.env.CLAUDEBOX_DEFAULT_BRANCH = "main"; -process.env.CLAUDEBOX_SESSION_USER = "testadmin"; +process.env.CLAUDEBOX_SESSION_USER = "testaztec";