Commit Graph

275 Commits

Author SHA1 Message Date
rob 06a1606370 Harden agent-friendly discovery and one-shot execution 2026-07-20 17:28:44 -03:00
rob 23723eaddb Add cmdforge list --json, --filter, and run-once for LLM-friendly one-shot execution 2026-07-20 17:11:21 -03:00
rob 56cb34276e Harden M9: Ed25519 attestation, full SHA-256 integrity, locked-by-default, prompt improvements, registry verification 2026-07-20 16:50:49 -03:00
rob 04153a4bbd M9.2-M9.5: Add improvement pipeline, community workflow, transitive integrity, and supply chain attestation 2026-07-20 15:43:14 -03:00
rob bf3686ae40 M9.1: Add prompt variation generation and optimization with cmdforge optimize command 2026-07-20 15:33:24 -03:00
rob 4d22d532a3 Harden M8 trust and guidance workflows 2026-07-20 15:21:50 -03:00
rob d954c1823a M8.C/A/D1/D2: Add reuse detection, audit evidence, deprecation, registry-aware picker 2026-07-20 14:46:03 -03:00
rob bda0c76d5f M8.Q/M8.D1: Add quality scoring engine and tool deprecation fields 2026-07-20 14:37:58 -03:00
rob 501e6cd589 Add evidence-based regression and schema compatibility checks 2026-07-20 14:21:42 -03:00
rob d81286e322 M8.0/M8.V1: Add contract inference engine and deterministic conformance testing 2026-07-20 13:34:13 -03:00
rob ba29e4dc4e Harden M8 preflight foundation 2026-07-20 12:08:38 -03:00
rob 188e167c1c Fix M8 foundation: dry-run exception handling, GUI close race, registry API, contract serialization, semver parser 2026-07-20 11:46:58 -03:00
rob f6bd640865 M8.PF: Add shared PreflightReport analyzer with cmdforge inspect command 2026-07-20 03:00:36 -03:00
rob 0323a39afb M8.0: Add tool-level input_schema and output_schema contracts to Tool 2026-07-20 02:58:46 -03:00
rob 23ac54f5c8 M7 follow-up: block GUI silent overwrite, connect registry publish --dry-run to preflight endpoint 2026-07-20 02:57:38 -03:00
rob 8366ef798b Harden M7.6/7.7: recursive restriction accumulation, MCP server enforcement, fast-fail authorization 2026-07-20 02:33:44 -03:00
rob 93ea80950e Add M7.6 provider tool access control and M7.7 agent delegation for ToolStep 2026-07-20 02:08:47 -03:00
rob 8d38bdd83a Add M7.5 provider-attached skills system with Agent Skills spec compliance 2026-07-20 02:01:35 -03:00
rob fe53721725 Harden M7.3 server: typed schemas, depth tracking, fnmatch, config preservation, and collision detection 2026-07-20 01:14:04 -03:00
rob 3525e2eeae Add M7.3 CmdForge as MCP server with FastMCP, expose/deny policy, and schema mapping 2026-07-20 00:24:54 -03:00
rob dee48d8cea Add M7.2 MCP client support with McpStep, CLI commands, and stdio transport 2026-07-20 00:20:40 -03:00
rob 6908d8ee6f Modernize provider support 2026-07-19 20:58:04 -03:00
rob 15943f251c Add proof-of-concept and before/after sections to philosophy page
- Added "Proof of Concept" section showcasing Orchestrated Discussions
  as a real-world example of the composable system (21 tools, 0 deps)
- Added "Before vs After" code comparison showing traditional Python
  approach vs CmdForge pipes/composition
- Visual flow diagram showing how tools chain together in practice

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-05 21:37:06 -03:00
rob 97be7e7b2d Update homepage messaging to emphasize capabilities paradigm
- Changed hero from "Build Custom AI Commands in YAML" to
  "Ask for Capabilities. Compose Solutions."
- Added semantic search demo in hero showing registry describe
- Renamed three pillars to: Ask for Capabilities, Compose Solutions,
  Share & Discover
- Added "See It In Action" section with side-by-side demos of
  semantic search and tool composition
- Added provider-agnostic callout highlighting multi-AI support
- Updated meta description to reflect vision
- Swapped secondary CTA from Tutorials to Philosophy page

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-05 19:12:15 -03:00
rob c920bb5384 Add Mermaid diagrams to Philosophy page
- Add Mermaid.js support to base template
- Add "The System" diagram showing AI assistant flow
- Add "Composable By Design" diagram showing tool composition
- Add "Future Vision" section with networked nodes diagram
- Diagrams from ChatGPT conversation about project vision

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-05 19:05:49 -03:00
rob b673ea019c Add provider for-tools command and max_tokens support
- Add 'cmdforge providers for-tools <tool>...' to list providers used by tools
- Add --warm flag to pre-load local models (Ollama) for faster first inference
- Warm larger models first to claim contiguous GPU memory
- Skip cloud providers (claude, opencode, gemini) during warm-up
- Add max_tokens field to PromptStep for controlling output length
- Pass max_tokens to call_provider with provider-specific flags
- Add comprehensive tests for provider functionality

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-04 17:50:26 -03:00
rob 468a999b80 Add Philosophy page and improve documentation
- Add /philosophy page explaining the paradigm shift from libraries to capabilities
- Visual diagrams comparing traditional vs CmdForge approach (bin of circuits vs organized workshop)
- Composition flow diagram showing tools chaining together
- Link from About page and homepage
- Update CLAUDE.md with accurate field names (output_schema not structured_output)
- Add Provider Install dialog to GUI dialogs list

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-04-04 17:49:59 -03:00
rob 1087b65c50 Update CLAUDE.md and AGENTS.md to reflect current codebase
- Add missing CLI subcommands (ui, docs, check, providers, deps, install, lock, verify, add, remove, init, config)
- Document new core modules (config.py, system_deps.py, dependency_graph.py, hash_utils.py)
- Update GUI structure (Welcome page, widgets/, expanded dialogs list)
- Add missing web modules (auth.py, sessions.py, email.py, seo.py)
- Add missing registry modules (categorize.py, rate_limit.py, scrutiny.py, similarity.py, stats.py, settings.py)
- Streamline AGENTS.md as quick reference that defers to CLAUDE.md

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-27 03:54:16 -04:00
rob 71c6358b9d Add provider fallback, visual schema builder, and UI improvements
Provider fallback system:
- Add optional fallback field to Provider dataclass
- Automatically try fallback provider when primary fails (timeout, error, offline)
- Prevent infinite loops with circular fallback detection
- Add fallback column and dropdown in providers UI

Visual schema builder for prompt steps:
- Add SchemaBuilderDialog with table-based field editor
- Support field name, type, description, and required flag
- Live JSON schema preview
- Integrate into PromptStepDialog with Edit Schema button
- Fix output_schema being lost when editing prompt steps

Other improvements:
- Add search box to tools page
- Improve schema example generation for structured output
- Update CLAUDE.md documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-21 00:50:18 -04:00
rob 8581775002 Implement structured output for prompt steps (Phase 1)
Add schema validation and retry logic for AI responses:

- Add output_schema, max_retries, plain_text fields to PromptStep
- Add DEFAULT_OUTPUT_SCHEMA with output/reasoning fields
- Implement append_schema_instructions() for prompt augmentation
- Implement validate_schema() using jsonschema library
- Add retry logic with error feedback on validation failure
- Enhance substitute_variables() for nested field access ({var.field})
- Add jsonschema to dependencies
- Update GUI dialog with plain_text checkbox and max_retries spinner
- Add comprehensive tests for structured output and nested access

Tools using plain_text=True bypass validation (current behavior).
Tools without plain_text get structured JSON output with schema enforcement.

Migration Phase 1 complete. Next: Apply plain_text=True to all 72 tools.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-17 17:34:48 -04:00
rob f980fe05f1 Add strip_fences option and fix exec() scoping for nested functions
- Add strip_fences field to PromptStep for removing markdown code fences
- Fix exec() to use same dict for globals and locals, allowing nested
  functions to access module-level imports
- Add GUI checkbox for strip_fences option
- Update CLAUDE.md with improved documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-17 16:14:45 -04:00
rob 33b807d545 Reduce backfill throttle to 0.1s to fit within gunicorn timeout
0.5s × 136 tools = 68s of sleep alone, which combined with network
time exceeded gunicorn's 120s worker timeout.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 08:17:56 -04:00
rob 5159450feb Add semantic search (RAG) for registry tool discovery
Users can now find tools by describing what they need in natural language.
Uses Ollama embeddings (nomic-embed-text) on AI-Server for vector similarity
search. Available via CLI (registry describe), GUI (AI search row), and API.

New files:
- registry/embeddings.py: core embedding logic (Ollama API, cosine similarity,
  pack/unpack vectors, backfill)
- tests/test_embeddings.py: 16 unit tests

Modified:
- registry/db.py: tool_embeddings table (schema + migration)
- registry/settings.py: embeddings.* settings (ollama_url, model, enabled, min_score)
- registry/app.py: semantic-search endpoint, publish hook, admin backfill/status
- registry_client.py: semantic_search() method with error surfacing
- gui/pages/registry_page.py: AI search row with SemanticSearchWorker
- cli/__init__.py + registry_commands.py: registry describe subcommand

Backfill required after deploy: POST /api/v1/admin/embeddings/backfill

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 01:52:27 -04:00
rob f24450c19c Fix update-readme CLI and allow admin to update any tool's README
Make tool argument optional when --all is used, add validation for
single-tool mode without tool name, and allow admin role to update
READMEs for tools owned by any publisher (e.g. official namespace).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 01:43:51 -04:00
rob e83c9c15f3 Add registry endpoint and CLI command for updating tool READMEs
- PATCH /api/v1/tools/<owner>/<name>/readme updates README without
  affecting config hash or requiring version bump
- Add RegistryClient.update_readme() method
- Add `cmdforge registry update-readme` CLI command with --all flag
  for batch updating all published tools

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 01:35:10 -04:00
rob f2cb9c0057 Add collapsible README viewer to tool details panel and owner override for publish
- Add collapsible README section to tools page detail panel with lazy loading
- README loads from disk only when user clicks the toggle bar
- Section collapses to a single header bar, expands to show content
- Add --owner flag to registry publish command for admin use
- Simplify dependency gathering in publish to use unified code path

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-01 01:26:56 -04:00
rob 94e33c0763 Update docs for tool ratings, reviews, and issue reporting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 03:50:28 -04:00
rob 23631ff4e7 Add Report Issue button to tool details panel
- Client: add submit_issue() method for POST /tools/{owner}/{name}/issues
- New IssueDialog with type (bug/compatibility/security), severity, title,
  and description fields with character count and validation
- Report Issue button in rating bar beside Rate Tool, visible for registry
  tools only. Submits via background SubmitIssueWorker thread.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 03:31:27 -04:00
rob a486bb6d45 Fix star rating buttons clipping text in review dialog
Increased button size from 36x36 to 40x40 and added padding: 0px so the
star glyphs render fully instead of being cut off on the sides.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 03:18:38 -04:00
rob 58e270746d Move slug fetch to background thread to prevent UI freeze
_fetch_my_slug() was making a synchronous HTTP request on the main thread
during tool selection, which froze the UI if the server was slow or
unreachable. Moved the /me call into StatusSyncWorker which already runs
in a background thread on page load. The slug is delivered via a
slug_fetched signal and the rate button re-evaluates when it arrives.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 03:11:49 -04:00
rob fe5b2047a9 Preserve registry fields on tool save and store owner in all publish paths
- save_tool() now preserves registry_hash, registry_status, registry_owner,
  and registry_feedback from existing config when writing Tool.to_dict(),
  preventing edits from erasing registry metadata.
- CLI publish (registry_commands.py) and collection publish
  (collections_commands.py) now save registry_owner from the publish
  response, matching the GUI publish dialog behavior.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 03:07:00 -04:00
rob 5ff108cdb3 Save and use registry_owner for rating lookups on flat-dir tools
Tools in flat directories (no owner subdir) had no way to resolve the
registry owner for rating API calls. This affected both own-published
tools and admin-published official tools.

- Publish dialog: save registry_owner from the publish response
- Status sync worker: backfill registry_owner from hash-based lookup
- get_tool_registry_info: check registry_owner before fallback_owner

Existing tools get backfilled on next background sync.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 02:59:46 -04:00
rob 9a284d7d04 Fix rating bar not showing for own published tools in flat directories
Tools published by the user and stored at ~/.cmdforge/<name>/ (no owner
subdir) had no way to resolve the registry owner, so get_tool_registry_info
returned None and the rating bar was hidden. Added fallback_owner parameter
that uses the current user's slug when no owner can be determined from the
path or config.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 02:42:24 -04:00
rob 7022bb10f2 Show ratings for own published tools, hide Rate button instead
Own tools now display the rating bar (average, count) so authors can
see how their tool is rated. The Rate button is hidden entirely for
own tools rather than shown disabled, since the server enforces the
self-review restriction anyway.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 02:36:32 -04:00
rob b1c73aba3f Move rating display and Rate button to bottom of tool details panel
Instead of the Rate button sitting in the action bar with Create/Edit/Delete,
the average rating, review count, and Rate/Edit Rating button now appear as
a bar at the bottom of the tool detail section where they contextually belong.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 02:27:54 -04:00
rob 14b3f3d856 Add tool rating & review from My Tools page
- Server: add GET /api/v1/tools/<owner>/<name>/my-review endpoint
- Client: add get_tool_rating, get_my_review, submit/update/delete review methods
- GUI: new ReviewDialog with star selector, title, content, submit/update/delete
- Tools page: rating display in details panel, Rate/Edit Rating button with
  context-sensitive enable/disable, background workers, rating cache
- Fix qualified name usage throughout tools page for owner-prefixed tools

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 02:15:23 -04:00
rob b00115a52e Add registry sort/pagination features and improve code step dialog
Registry:
- Add owner and rating sort options to both server endpoints
- Add letter-based prefix filtering (A-Z, #) with server-side validation
- LEFT JOIN tool_stats for average_rating/rating_count in responses
- Add interactive numbered page buttons with sliding window and ellipsis
- Add letter bar UI (shown when sorting by name) with highlight state
- Auto-select asc/desc order based on sort field
- Disable cell editing on results table
- Client: add order and prefix params to list_tools/search_tools

Code step dialog:
- Split AI prompt into user instruction input and collapsible wrapper
- User types plain instruction, wrapper is hidden by default
- Injection of user text into wrapper via {user_instruction} placeholder
- Increase dialog minimum height to 750px

Runner:
- Support variable substitution in prompt step provider name

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 01:35:03 -04:00
rob 0ee21f27f7 Add admin publish-as-official, hash-based status sync, and GUI fixes
Registry:
- Add admin owner override for publishing tools as "official"
- Add POST /api/v1/tools/status-by-hash batch endpoint for status lookup
  scoped to publisher_id (works for tools published under any owner)

GUI:
- Add "Publish as" dropdown in publish dialog for admin users
- Add "installed" tool state (teal with arrow indicator) for registry-installed tools
- Fix tool editing for official/* qualified tool names (_get_qualified_name helper)
- Fix cancel navigation returning to wrong page (Welcome instead of Tools)
- Fix collections tab not refreshing after publish
- Refactor StatusSyncWorker to use batch hash lookup (1 request instead of N)
  with chunking (100 max) and hash collision handling

CLI:
- Switch registry status sync to hash-based lookup
- Add collection dependency checking and unpublished dep detection

Publish dialog cleanup:
- Move yaml import to module level, remove duplicate _bump_patch_version
- Fix owner combo using currentText() for reliable selection

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-29 17:18:37 -04:00
rob 071ade0ffb Add system dependencies support for tools
Tools can now declare system-level package dependencies (apt, brew, pacman, dnf)
that get checked and optionally installed when the tool is installed or run.

Features:
- SystemDependency dataclass with short form (string) and long form (dict)
- New system_deps.py module with platform detection and installation
- `cmdforge system-deps <tool>` command to check/install system packages
- `cmdforge check` now shows both CmdForge and system dependencies
- `cmdforge registry install` prompts for system dep installation
- GUI: System Dependencies section in Tool Builder with add/edit dialog
- Runner warns about missing system deps before execution
- Integration with project install (manifest and lock-based)

Also includes:
- Quote paths in wrapper scripts for spaces support
- Tests for value type preservation in code steps
- Unskip invalid tool name test

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-28 16:31:37 -04:00
rob 8eff55ed1e Add tool settings files for configurable tool defaults
Tools can now ship with defaults.yaml containing configurable settings
that users can customize via settings.yaml (auto-created from defaults).

Features:
- ensure_settings() helper copies defaults to settings on first use
- Settings available as {settings.key} in templates (scalars only)
- Full dict access via settings['key'] in code steps
- CLI: cmdforge settings <tool> show/edit/reset/diff
- GUI: Defaults editor in Tool Builder, Configure button on Tools page
- Registry: defaults.yaml published with tools, included in downloads
- Secret detection warning on publish (api_key, password, token, etc.)

Fully backward compatible - tools without defaults work unchanged.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-27 11:56:07 -04:00