Skip to content

Release/store swarm cicd - #8

Merged
ralyodio merged 3 commits into
mainfrom
release/store-swarm-cicd
Jun 25, 2026
Merged

Release/store swarm cicd#8
ralyodio merged 3 commits into
mainfrom
release/store-swarm-cicd

Conversation

@ralyodio

@ralyodio ralyodio commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

No description provided.

ralyodio and others added 3 commits June 25, 2026 19:03
@ralyodio @claude
feat(store): CI/CD publishing — publisher API tokens + publish script
3b4a493 
Lets extensions be published from git/CI instead of the web form. The only
backend gap was headless auth, so this adds long-lived publisher API tokens:
- migration 0005_publisher_tokens (stores only the sha256 of the token)
- mint/list/revoke endpoints; minting requires a real session (a leaked CI
  token can't mint more); store currentUser() resolves `tbpub_…` bearers
- scripts/publish-extension.sh: zip → scp to files.profullstack.com → register
  the new version via the API with the token (generic; any CI)
- docs/ci-publishing.md: token + SSH-key setup and a paste-in GitHub workflow

scp upload + the version endpoint + slug lookup already existed, so CI reuses
them. Typecheck clean; token mint/resolve/list/revoke round-trip verified.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@ralyodio @claude
feat(api): /api/swarm — deepagents agent swarm via @logicsrc/agentswarm
8c7c133 
Signed-in, bring-your-own-key endpoint that runs a deepagents-backed swarm.
Caller supplies provider + apiKey per request (transient, not stored — same
pattern as /api/models); anthropic uses ChatAnthropic, other providers use the
OpenAI-compatible adapter (incl. optional c0mpute.com GPUs). An optional `rubric`
enables the self-check loop. Mounted at /api/swarm, auth via currentUser.

Adds @logicsrc/agentswarm + deepagents + @langchain/{langgraph,anthropic,openai}.
Typecheck clean (Docker tsconfig), boots, route auth-gated (401 without session).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@ralyodio @claude
ai-sidebar: add email/password sign-in + sign-up (alongside CoinPay)
867fdf1 
- shared storeSession() persists a TronBrowser session token from any auth
  method; emailSignIn/emailSignUp hit the same /api/auth/login + /signup the
  website uses and store the returned token like CoinPay.
- options UI gains the email/password fields.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@socket-security

socket-security Bot commented Jun 25, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​logicsrc/​agentswarm@​0.1.07510010086100
Addeddeepagents@​1.10.57910010098100
Added@​langchain/​langgraph@​1.4.6991009297100
Added@​langchain/​openai@​1.5.310010010097100
Added@​langchain/​anthropic@​1.5.110010010097100

View full report

@socket-security

socket-security Bot commented Jun 25, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Publisher changed: npm @langchain/protocol is now published by lc-oss-admin

Author: lc-oss-admin

From: ? → npm/deepagents@1.10.5 → npm/@langchain/langgraph@1.4.6 → npm/@langchain/protocol@0.0.18

ℹ Read more on: This package | This alert | What is unstable ownership?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@langchain/protocol@0.0.18. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-tiktoken is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ? → npm/deepagents@1.10.5 → npm/@langchain/anthropic@1.5.1 → npm/@langchain/openai@1.5.3 → npm/@langchain/langgraph@1.4.6 → npm/js-tiktoken@1.0.21

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-tiktoken@1.0.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-tiktoken is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ? → npm/deepagents@1.10.5 → npm/@langchain/anthropic@1.5.1 → npm/@langchain/openai@1.5.3 → npm/@langchain/langgraph@1.4.6 → npm/js-tiktoken@1.0.21

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-tiktoken@1.0.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@ralyodio
ralyodio merged commit 72ff9a7 into main Jun 25, 2026
2 checks passed
@ralyodio
ralyodio deleted the release/store-swarm-cicd branch June 25, 2026 19:30
@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralyodio