Skip to content

v1.2.2

Choose a tag to compare

View all tags
@nikolanovoselec nikolanovoselec released this 04 Aug 14:22
v1.2.2
4a5de6a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Governed Browser IDE, Native Pi Goal, Reproducible Supply Chain, Faster CI, Agent Runtime Hardening

v1.2.2 connects the editor, agent runtime, deployment pipeline, and release artifact under one governed execution model. Sessions gain a pinned Browser IDE with native Pi and Claude integrations, browser notifications, durable memory recall, enterprise agent controls, faster fail-closed CI, selectable production images, exact vulnerability policy, and deterministic keylessly signed source releases.

Browser IDE

Pinned code-server workspace

Each session includes code-server 4.131.0 with Code OSS 1.131.0 behind the authenticated /api/vscode/<sessionId>/ Worker route. The implementation provides:

  • Lazy startup, so sessions that never open the editor do not pay its runtime cost.
  • A fixed /home/user/workspace projection with a clean public URL.
  • Origin enforcement and bearer validation across HTTP and WebSocket upgrades.
  • Correct rewriting for prefixed redirects, assets, service workers, cookies, and socket paths.
  • Bounded readiness pages for both container startup and editor binding, with elapsed-time reporting and a terminal failure state.
  • Process-generation ownership, startup cancellation, restart supervision, resource ceilings, and complete descendant cleanup.
  • Runtime inventory metadata for unsupported or intentionally empty editor-agent configurations.

Workspace trust and extension-recommendation prompts are disabled for Pi, Claude, and plain editor sessions. The ephemeral authenticated session container is the trust boundary.

Native Pi Chat

Pi is the default participant in the editor’s native Chat interface. Every request runs through a fresh isolated local RPC turn with:

  • Active-editor text and selection context.
  • Open-file references and diagnostics under explicit budgets.
  • Conversation replay selected newest-first, then restored to conversational order.
  • A 512 KiB replay budget inside a 1 MiB context envelope.
  • Whole-unit fallback ordering that preserves the active editor longest and never truncates the structured context mid-object.
  • An inert compatibility model satisfying code-server’s model-resolution boundary without routing inference through the editor or requesting another account.
  • Process lifecycle guarantees covering activation, disposal, cancellation, and restart.

Review with Codeflare reviews the active editor through the session’s existing agent path. Pi remains account-free in the editor.

Official Claude integration

Claude sessions use Anthropic’s official extension with managed settings and an authenticated loopback IDE MCP. The Claude panel is the sole Claude conversation surface, generic editor account setup remains separate, and no Codeflare credential is exported into editor account flows. Claude and Pi operate inside the ephemeral session container without approval-tab interruptions.

Session-isolated UI continuity

Codeflare restores a bounded allowlist of credential-free editor preferences after an editor process generation ends. Capture and restore are keyed to the observed workspace-storage identity and applied atomically. Authentication, extension state, chat history, workspace databases, logs, WAL, SHM, and other credential-bearing or session-bearing state remain isolated.

Agent experience

Native browser notifications

Pi and Claude emit OSC 777 terminal events that become OS-level browser notifications. Delivery includes:

  • An unconditionally registered terminal handler that resolves session identity when the event arrives.
  • An activated-service-worker requirement before display.
  • Session-derived titles rather than terminal-controlled identity text.
  • Replacement of repeated notifications instead of notification stacking.
  • Click handling that focuses the live tab across SPA navigation and query changes.
  • Claude notifications for task completion and permission prompts while the terminal is unfocused.
  • Pi notifications for completion and questions awaiting the user.
  • A guided Home Screen installation path for iOS notification support.

Managed extension backfill delivers notification support to restored sessions after deployment while respecting session-mode filtering.

Native Goal workflow for Pi

@narumitw/pi-goal 0.43.0 is exact-pinned, integrity-locked, and prewarmed in the deployment image. Image verification loads the installed entrypoint, derives the same realpath-based Jiti artifact used by runtime sessions, and requires that artifact to exist as a regular file.

Runtime behavior includes:

  • Working /goal, goal_complete, and goal_blocked tools after activation and reload.
  • Lazy tool visibility for users without Goal settings.
  • Preservation of every existing pi-goal.json preference.
  • Tool retention for unfinished restored Goals and users selecting an always-visible policy.
  • Compatibility with Codeflare’s Explore agent.
  • Review-boundary pause and resume tied to the exact bridge-owned Goal and acknowledged FIX continuation.

Cleaner terminal operation

Background subagents continue to run without a full-screen agent view replacing the terminal. This keeps Claude usable on mobile while preserving memory capture, Vault extraction, and reviewer execution.

Review and agent governance

Scoped review evidence

Code and documentation reviewers receive deterministic evidence packets containing changed files, exact old/new hunk ranges, resolved source anchors, dependency declarations, and cross-lane inputs invalidated by the changed hunks. Universal review policy ships with each lane; larger conditional policy is fetched within an existing evidence wave.

Lane selection is surface-aware:

  • Behavioral source changes receive code review.
  • Specification and documentation reviewers run when their owned files or anchors intersect the range.
  • Comment-and-whitespace-only deltas can be proven inert by one shared scanner while still receiving code review.
  • File-mode changes, symlinks, unsupported syntax, ambiguous regular expressions, binary input, and unresolved repository state fail closed to broader review.
  • Claude and Pi use the same inert-delta prover and lane mapping contract.

Published verdict and ordered FIX handoff

Review acknowledgement requires a structured triage verdict published after every required lane returns. Each row records finding validity, proposed-fix validity, proportionality, and the minimal decision. Acknowledgement, CI checkpointing, and the separate FIX continuation remain ordered, and report-only triage cannot mutate the reviewed head.

All-LOW rounds complete the reviewed head while batching their fixes into the next planned push. MEDIUM and higher findings require correction and another review of the next authoritative pushed head.

Authoritative PR boundaries

Boundary detection verifies the canonical repository, checked-out branch, local HEAD, protected-base PR, and GitHub’s exact PR head. Detached checkouts and unrelated worktrees stay inert. Review and CI checkpoints are scoped per PR so one branch cannot acknowledge another branch’s work.

CI monitor identity carries repository, PR number, exact head, and repository path as one structured value. Successful results checkpoint only after all four values are revalidated. Settled recovery consults that checkpoint before scheduling follow-up work, preventing duplicate monitoring after delayed notifications or transcript compaction.

Memory, Vault, and session reliability

Post-compaction recall

Claude and Pi inject the same bounded digest of recent session extracts after compaction. The digest restores narrative and decisions as historical context, not instructions. Selection and rendering provide:

  • Recency from timezone-bearing capture filenames rather than sync-mutated mtimes.
  • Collision-resistant Pi filenames using the random UUIDv7 tail.
  • Fence parsing by delimiter run length.
  • Encoded-byte budgets that include truncation notices.
  • Runtime-specific closing guidance with byte-identical selected evidence.
  • Child-session suppression so capture and review agents do not recursively inject memory.

Bounded capture with citation preservation

Memory capture is bounded by payload cost instead of message count. User prompts are selected newest-first before assistant turns, every turn has a maximum size, and the total payload has a hard character ceiling. Requirement IDs, decision-record numbers, pull-request numbers, and commit hashes are rescued into a compact trailing line when truncation would otherwise remove them. Claude and Pi produce the same selection and citation rescue for the same transcript.

Prompt-aware graph retrieval

The first-prompt injector supports the cumulative unified graph under a measured 100 MB memory guard. A graph over the guard does not consume the session’s one-shot sentinel, allowing a later prompt to retry after the graph changes. Prompt-aware retrieval, graph-first discipline, and explicit Graphify tools remain the sources of code and Vault context.

Preseed lifecycle and hook reliability

Product-owned seeded files carry ownership metadata tied to the build’s preseed hash. Reconciliation can remove files the product no longer ships while preserving user-created files and files a user has edited. Historical product-owned keys receive a bounded clean-slate pass, and current-mode keys are protected from deletion.

Executable hook permissions are repaired at boot and after every successful bisync. Managed Pi extensions are mirrored from the mode-filtered image bake, including extensions introduced after a user bucket was created, while pi-goal.json, authentication, MCP, and user settings remain untouched.

Shutdown and final sync

Container shutdown cancels background initialization before daemon teardown, prevents late supervisor starts, reaps the Browser IDE and its descendants, waits for active sync work to quiesce, and performs one guarded final R2 bisync inside the established teardown budget. Signal and EXIT handling share one idempotent path, preventing a second fresh sync from starting after watchdog cleanup.

Enterprise governance

Deployment-selected coding agents

Deployments can set the environment-scoped CODING_AGENTS variable using the canonical ordered inventory:

claude-code,codex,copilot,antigravity,opencode,pi

An unset value installs all six. Bash remains independently available. Selection applies to shared coding-agent CLIs while Pi’s dedicated prewarm/Jiti runtime and native Browser IDE assets remain installed under their separate contracts.

Complete-image verification requires every selected launcher to execute and report the expected identity and every omitted launcher to be absent. The API, Setup wizard, preferences, session creation, and new-session interfaces derive their choices from the installed deployment inventory.

Enterprise active-agent controls

Enterprise Setup includes a Coding Agents multi-select with canonical ordering, minimum-one validation, KV persistence, and prefill round-trip. Session creation and lastAgentType writes reject deactivated agents at the API boundary. The dashboard and GitHub clone picker receive the active set from the server. Bash remains selectable, existing sessions remain valid, and an absent or malformed selection resolves to the full capable set.

Enterprise session mode resolves to Pro at every read, write, reconciliation, and container boundary. Retryable upgrade state is preserved, and preferences changed during reconciliation are not overwritten.

Protected production promotion

Protected main accepts pull requests only from canonical develop in the canonical repository. Source repository, source branch, and exact promotion head are validated. CodeQL and fuzzing cover both protected branches, and production deployment remains restricted to main.

GitHub integration

Persistent Connect GitHub OAuth credentials request gist in Minimal, Recommended, and Advanced tiers. Direct GitHub login requests exactly user:email for identity resolution. Route-selected and provider-default authorization read from the same server-owned scope catalog.

Operator action: existing OAuth App connections must disconnect and reconnect once to receive the gist grant. OAuth scopes cannot be added retroactively to an issued token. GitHub App installations are unaffected.

CI and deployment

Parallel fail-closed source verification

PR Checks run path-filtered workload lanes behind the required test context:

  • Quality: lint, Knip, dependency audit, generated-seed drift, and package integrity.
  • TypeScript type checking.
  • Five backend shards plus the Node-environment suite.
  • Three frontend shards.
  • Landing tests.
  • Host and shell-runtime tests.
  • Browser IDE extension and integration tests.
  • Backend and frontend coverage.
  • Bundle-size enforcement from Wrangler’s dry-run measurement.
  • Dependency review.
  • actionlint and Zizmor workflow analysis.

Machine-readable gates require non-empty, complete, internally consistent reports. Every test file must appear in the expected suite inventory. The bounded Workers-pool teardown exception is accepted only after the report proves tests ran with zero failures and matches the exact known fingerprint. Full lane matrices also run nightly.

Exact-commit manual deployments

Manual deployment verifies the exact commit selected for release. Preparation, Worker build, container build, and deployment are gated on that verification result. A terminal outcome job fails any run in which deployment did not complete, including cancelled verification. Run titles include the resolved target environment, and concurrent environment dispatches receive independent verification groups.

PR checks own source verification. Deployment owns complete-image construction, selected-agent smoke, Pi and Claude packaged-runtime smoke, prefixed Browser IDE proxy smoke, Trivy evaluation, SBOM generation, provenance attestation, registry cache management, publication, Worker rollout, and health verification.

Trusted build cache and registry handling

Container input identity covers every Dockerfile COPY source and the workflow contract. Cache reads are limited to trusted refs. Registry credentials are step-scoped and masked before use, registry pagination is complete before pruning, digest aliases are protected, and unresolved image metadata fails closed.

Stress suites continue to exercise API throughput, rate limiting, session lifecycle, and storage behavior with service authentication. Deployed browser verification covers interaction, responsive behavior, native editor paths, and notification delivery.

Supply chain and release integrity

Lock-backed privileged tooling

Agent CLIs, Bun, context-mode, consult-llm, Chrome DevTools MCP, Browser Run MCP, workflow Wrangler, and other privileged npm tools install from committed manifests and lockfiles. Regeneration suppresses lifecycle scripts, applies bounded integrity corrections, and verifies manifest/lock/generated-seed/Pi-prewarm coherence.

The uv bootstrap uses a pinned release archive with an authoritative SHA-256 digest. Workflow tools use reviewed exact versions or commit SHAs, and action metadata is checked against a central pin inventory.

The resulting lock trees contain patched dependency versions for the reported brace-expansion, protobufjs, undici, ws, @babel/core, @hono/node-server, and related findings.

Coupled runtime updates

Weekly Shadow Pins automation updates each package through its owning manifest and regenerates the corresponding committed lock. Pi updates also regenerate runtime, prewarm, packed correction, and generated-seed artifacts.

SilverBullet 2.10.0 is managed as one binary/service-worker release unit. Automation verifies the authoritative release digest, archive version, served version, native worker, cache policy, graft anchors, replacement boundaries, and literal replacement semantics before updating both artifacts.

code-server 4.131.0 and Code OSS 1.131.0 are managed as a coupled pair. Automation verifies the immutable release tag, packaged runtime commit, embedded VS Code gitlink, and archive metadata.

Smaller Linux images

The Linux x64 image prunes alternate operating systems, architectures, musl and baseline variants, unused prebuilds, duplicate native payloads, package-manager caches, temporary files, and transient compiler packages after lock-backed installation.

The verified integration image is 3,926,606,160 bytes, compared with the prior measured 4,602,004,252-byte image: 675,398,092 bytes, or approximately 14.7%, smaller. Selected launchers, Pi prewarm/Jiti, native IDE assets, and runtime capability checks remain intact.

Exact Trivy identities

Every accepted vulnerability occurrence is bound to its reviewed target, package, installed version, fixed version, severity, multiplicity, package path, and PURL. The validator evaluates the complete result set. Missing, extra, duplicate, target-drifted, version-drifted, path-drifted, PURL-drifted, severity-drifted, and unrelated findings fail together. Successful scans publish each accepted identity as evidence.

Deterministic keyless releases

Published semantic releases validate tag shape, release state, and protected-main ancestry before building deterministic source archives and SHA-256 manifests. Exact-pinned Sigstore tooling signs both artifacts through GitHub OIDC. Self-contained Sigstore bundles and GitHub provenance attestations are published as separate evidence. No private signing key, signing password, or long-lived signing credential is stored.

UI and product presentation

Execution overview

The landing page presents Codeflare as the customer-operated environment where engineers and agents architect, build, debug, operate, patch, migrate, test, deploy, verify, and recover systems. A canonical two-terminal Execution reel follows Hero and Inference Mesh, with:

  • Eight complete rows per session.
  • Shared transcript, typing, rolling, wrapping, tone, and caret behavior.
  • Stable side-by-side desktop and tablet layouts with mobile stacking.
  • Complete static content without JavaScript.
  • Reduced-motion rendering.
  • Capture-ready settled states.
  • Links to the merged pull requests represented by each execution.

Design-system consistency

Semantic color and typography tokens cover danger, primary and secondary surfaces, hover states, tertiary text, compact text, and action variants. Error, pending, auth, MultiView, and admin-hint states meet their intended contrast. Onboarding and subscription accents follow the active theme. Alpha variants derive from semantic RGB channel tokens.

Reusable PageFooter and AdminActionButton components provide one source of truth for repeated structure and styling across authentication, onboarding, subscription, and administration surfaces.

Architecture, specification, and documentation

The Worker and host codebases include clearer owned boundaries for Vault routing and validation, container interception, request routing, terminal WebSocket upgrades, session/setup stores, environment typing, and splash-cursor behavior. External JSON, authentication, workspace selectors, OAuth scopes, and runtime configuration are validated at their boundaries.

Behavioral coverage executes real shell blocks, HTTP routes, workflow dispatch logic, parsers, dependency update scripts, runtime activation, and state transitions. Specification anchors, verification links, acceptance criteria, ADRs, API inventories, and owned documentation are reconciled to the shipped behavior.

The final Graphify publication contains 13,653 nodes, 31,622 edges, and 665 communities, with zero duplicate node IDs and zero dangling edges. GRAPH_REPORT.md, graph.html, and callflow.html are generated together. Community labels remain optional.

Dependency highlights

  • code-server 4.131.0 / Code OSS 1.131.0
  • SilverBullet 2.10.0
  • Pi coding agent 0.82.0 with native Goal 0.43.0
  • Updated Claude Code, official Claude extension, OpenCode, Copilot, Pi subagents, Graphify, Impeccable, context-mode, MCP/web-access tooling, Hono, Typebox, Wrangler, Vite, Astro, Vitest, Knip, fast-check, xterm, fonts, and pinned GitHub Actions
  • Consolidated lockfiles and generated agent seed across all shipped package roots

Delivery evidence

Full Changelog: v1.2.1...v1.2.2

Assets 6
Loading