Repository navigation
Update to final demo video v3 - #17
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This was referenced Apr 21, 2026
liususan091219
added a commit
that referenced
this pull request
Apr 21, 2026
…19,23,28-31,45-47) (#492) Resolves the remaining 11 py/path-injection alerts by switching _safe_path (agent-api.py), _resolve_note_path (dashboard.py), and the /answer inline handler to the CodeQL-recognized sanitizer pair: Path::PathNormalization : os.path.realpath Path::SafeAccessCheck : str.startswith(base + os.sep) Path.resolve / Path.is_relative_to are NOT in codeql/python-all's PathInjection customizations (Stdlib.qll only models os.path.normpath, abspath, realpath and str.startswith), which is why prior refactors #487/#488 didn't close the alerts. Verified locally with CodeQL CLI 2.25.2 + codeql/python-queries 1.8.0: before: 11 path-injection alerts (current main at dc7bfbe) after: 0 path-injection alerts Behavioral sanity checks unchanged: traversal, absolute, empty, and dotfile inputs are all stripped by the existing regex whitelist and then confined by the realpath + startswith guard. Co-authored-by: Xueqing Liu <xueqingliu@Xueqings-Mac-Studio.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
3 tasks
sonichi
added a commit
that referenced
this pull request
May 3, 2026
…579) Picks up two upstream merges: - #16 replay-text wait-silently in BOTH reconnect paths (eliminates greeting bleed-through after reconnect) - #17 deadline the reconnect promise to avoid stuck RECONNECTING after ECONNRESET-during-reconnect (previously required launchctl kickstart to recover; observed 5+ min stuck on 2026-05-01)
2 of 3 tasks
3 tasks
sonichi
pushed a commit
that referenced
this pull request
May 5, 2026
PR #579 bumped the dependency reference but left the resolved field at ee58489a, so `npm install` reused the cached older bodhi tarball. Voice agents started after #579 still loaded the pre-fix code (no silent-replay instructions on either reconnect path). Fix: rerun `npm install github:sonichi/bodhi_realtime_agent#ffec0cd` to update the resolved entry. Now next voice-agent restart actually picks up bodhi #16 (silent-replay text in both reconnect paths) and #17 (reconnect promise deadline). Co-authored-by: Vasiliy Radostev <vasiliyr@Vasiliys-MacBook-Pro.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 of 8 tasks
liususan091219
pushed a commit
to liususan091219/sutando-fork
that referenced
this pull request
May 28, 2026
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
liususan091219
added a commit
to liususan091219/sutando-fork
that referenced
this pull request
May 28, 2026
…chi#17-19,23,28-31,45-47) (sonichi#492) Resolves the remaining 11 py/path-injection alerts by switching _safe_path (agent-api.py), _resolve_note_path (dashboard.py), and the /answer inline handler to the CodeQL-recognized sanitizer pair: Path::PathNormalization : os.path.realpath Path::SafeAccessCheck : str.startswith(base + os.sep) Path.resolve / Path.is_relative_to are NOT in codeql/python-all's PathInjection customizations (Stdlib.qll only models os.path.normpath, abspath, realpath and str.startswith), which is why prior refactors sonichi#487/sonichi#488 didn't close the alerts. Verified locally with CodeQL CLI 2.25.2 + codeql/python-queries 1.8.0: before: 11 path-injection alerts (current main at dc7bfbe) after: 0 path-injection alerts Behavioral sanity checks unchanged: traversal, absolute, empty, and dotfile inputs are all stripped by the existing regex whitelist and then confined by the realpath + startswith guard. Co-authored-by: Xueqing Liu <xueqingliu@Xueqings-Mac-Studio.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
liususan091219
pushed a commit
to liususan091219/sutando-fork
that referenced
this pull request
May 28, 2026
…onichi#579) Picks up two upstream merges: - sonichi#16 replay-text wait-silently in BOTH reconnect paths (eliminates greeting bleed-through after reconnect) - sonichi#17 deadline the reconnect promise to avoid stuck RECONNECTING after ECONNRESET-during-reconnect (previously required launchctl kickstart to recover; observed 5+ min stuck on 2026-05-01)
liususan091219
pushed a commit
to liususan091219/sutando-fork
that referenced
this pull request
May 28, 2026
…#593) PR sonichi#579 bumped the dependency reference but left the resolved field at ee58489a, so `npm install` reused the cached older bodhi tarball. Voice agents started after sonichi#579 still loaded the pre-fix code (no silent-replay instructions on either reconnect path). Fix: rerun `npm install github:sonichi/bodhi_realtime_agent#ffec0cd` to update the resolved entry. Now next voice-agent restart actually picks up bodhi sonichi#16 (silent-replay text in both reconnect paths) and sonichi#17 (reconnect promise deadline). Co-authored-by: Vasiliy Radostev <vasiliyr@Vasiliys-MacBook-Pro.local> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 of 31 tasks
qingyun-wu
added a commit
that referenced
this pull request
May 31, 2026
… vault) Big flip from v0.7: workspace defaults to $SUTANDO_REPO_DIR/workspace/ (gitignored subdir of the repo) instead of ~/.sutando/workspace/. Vault becomes an explicit user-created git remote, opt-in per scope. Why this simplifies things: - Workspace is naturally cwd-anchored. Claude Code's native CLAUDE.md / .claude/settings / skills / .mcp.json / plugins discovery activates over workspace content with no overlay machinery. - v0.7's opt-in cwd-overlay (§2.5.7 + §2.5.8 mount/cp split, locks #17/#18/#19) retires entirely. Workspace is already in cwd; no symlinks to manage. - New-install UX: zero config. Clone repo + run = workspace appears at <repo>/workspace/, gitignored. Vault opt-in for cross-machine sync. What's preserved: - 2-axis model: scope (personal / room) × tier (LOCAL / MACHINE / AGENT / ROOM), tier inferred from path location (v0.6-C naming convention). - Read-union + write-scoped (R-1). - Memory M-1..M-4 symlink + demotion-on-conflict. - Private/public zone + bot quotability ladder (§2.2.1). - Per-room sub-vaults; secret-scan push-gate; auto-generated layout docs. What's new in v0.8 locks (§2.8): - #17: $SUTANDO_WORKSPACE default = $SUTANDO_REPO_DIR/workspace/. - #18: Vault is explicit user-created (sync-engine.sh create-vault). - #19: Skills overlay = small <cwd>/.claude/skills/ws-<name>/ symlinks to workspace skills (pending §2.5.8 Option A empirical test). - v0.7 #17/#18/#19 (overlay machinery) marked RETIRED. 7 open implementation-phase concerns documented in §2.9, including the §2.5.8 empirical test (does Claude Code auto-register skills under <cwd>/workspace/skills/, or do we need the .claude/skills/ symlink?) as the blocking decision for the skills overlay shape. Author-defaulted [OPEN] decisions called out inline; owner can override. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final corrected demo video.