Repository navigation

Coding-agent surfaces: kit HTML and choices kinds, CLI, self-hosted hardening, token bench - #108

Closed

baanish wants to merge 32 commits into

mainfrom

coding-agent-optimization

Commits on Jul 31, 2026
- viewer: kit html and choices artifact kinds
  
  baanish
  and
  claude
  committed
  18b3b32
- selfhosted: 7-day default TTL, env override, optional password gate
  
  baanish
  and
  claude
  committed
  2061858
- cli: @agent-render/cli workspace with create command
  
  baanish
  and
  claude
  committed
  0cb68b4
- bench: measure fragment codecs in tokens, not chars
  
  baanish
  and
  claude
  committed
  c55be58
- integration: cli html/choices kinds, workspace lockfile, bench report into docs
  
  baanish
  and
  claude
  committed
  621386f
- build: root typecheck excludes cli workspace and runs its own tsc
  
  baanish
  and
  claude
  committed
  6700f05
- selfhosted: derive auth key via scrypt, gate Secure cookie on TLS
  
  baanish
  and
  claude
  committed
  7b48ca0
- harden kit html and self-hosted auth after review
  
  baanish
  and
  claude
  committed
  289c54c
- bound choices payloads, guard CLI size, fix review doc/CI gaps
  
  baanish
  and
  claude
  committed
  8a6e055
- fix trust-drop race and sanitizer stack overflow
  
  baanish
  and
  claude
  committed
  b6214b9
- selfhosted: fail fast on unusable config, decouple cookie from password
  
  baanish
  and
  claude
  committed
  fc6e3bf
- enforce choices caps at encode time, harden CLI edge cases
  
  baanish
  and
  claude
  committed
  bd0189e
- align docs with the shipped behavior
  
  baanish
  and
  claude
  committed
  0dcfee2
- ignore local planning docs
  
  baanish
  and
  claude
  committed
  de10986
- keep tuple codecs away from html payloads
  
  baanish
  and
  claude
  committed
  5d64c29
- replace the choices artifact kind with a kit component
  
  baanish
  and
  claude
  committed
  b293a73
- correct the homepage kind count and pin the ar-choices contract
  
  baanish
  and
  claude
  committed
  2b42171
- fix the ar-choices example to match its own options
  
  baanish
  and
  claude
  committed
  0505f46
- tighten the trusted sandbox, href parsing, and forwarded-proto trust
  
  baanish
  and
  claude
  committed
  4d5d9ad
- rate-limit failed auth attempts before the KDF
  
  baanish
  and
  claude
  committed
  1249900
- regenerate the skill discovery digests and guard them
  
  baanish
  and
  claude
  committed
  4501eed
- stop the CLI sending one instance's token to another host
  
  baanish
  and
  claude
  committed
  81b9fc0
- fail closed on an empty password, and stop caching authenticated responses
  
  baanish
  and
  claude
  committed
  f40b696
- render the ar-choices detail line under its label
  
  baanish
  and
  claude
  committed
  3025aa3
- key auth rate limiting per client, not per proxy
  
  baanish
  and
  claude
  committed
  2340ef4
- serve trusted HTML from an isolated frame with its own CSP
  
  baanish
  and
  claude
  committed
  4b15d35
- actually stop the CLI leaking a token across instances
  
  baanish
  and
  claude
  committed
  17c4056
Commits on Aug 1, 2026
- close the image beacon channel in the frame CSP
  
  baanish
  and
  claude
  committed
  e0c5f47
- bind stored tokens to their stored endpoint, decode input strictly
  
  baanish
  and
  claude
  committed
  358ecb2
- count in-flight derivations against the auth rate limit
  
  baanish
  and
  claude
  committed
  c352fed
- stop claiming the isolation frame prevents exfiltration
  
  baanish
  and
  claude
  committed
  aa2d73b
- bind every layer's token to the endpoint it names
  
  baanish
  and
  claude
  committed
  321ee50

Navigation Menu

Repository navigation

Coding-agent surfaces: kit HTML and choices kinds, CLI, self-hosted hardening, token bench - #108

Coding-agent surfaces: kit HTML and choices kinds, CLI, self-hosted hardening, token bench#108
baanish wants to merge 32 commits into
mainfrom
coding-agent-optimization

Commits on Jul 31, 2026

viewer: kit html and choices artifact kinds

selfhosted: 7-day default TTL, env override, optional password gate

cli: @agent-render/cli workspace with create command

bench: measure fragment codecs in tokens, not chars

integration: cli html/choices kinds, workspace lockfile, bench report into docs

build: root typecheck excludes cli workspace and runs its own tsc

selfhosted: derive auth key via scrypt, gate Secure cookie on TLS

harden kit html and self-hosted auth after review

bound choices payloads, guard CLI size, fix review doc/CI gaps

fix trust-drop race and sanitizer stack overflow

selfhosted: fail fast on unusable config, decouple cookie from password

enforce choices caps at encode time, harden CLI edge cases

align docs with the shipped behavior

ignore local planning docs

keep tuple codecs away from html payloads

replace the choices artifact kind with a kit component

correct the homepage kind count and pin the ar-choices contract

fix the ar-choices example to match its own options

tighten the trusted sandbox, href parsing, and forwarded-proto trust

rate-limit failed auth attempts before the KDF

regenerate the skill discovery digests and guard them

stop the CLI sending one instance's token to another host

fail closed on an empty password, and stop caching authenticated responses

render the ar-choices detail line under its label

key auth rate limiting per client, not per proxy

serve trusted HTML from an isolated frame with its own CSP

actually stop the CLI leaking a token across instances

Commits on Aug 1, 2026

close the image beacon channel in the frame CSP

bind stored tokens to their stored endpoint, decode input strictly

count in-flight derivations against the auth rate limit

stop claiming the isolation frame prevents exfiltration

bind every layer's token to the endpoint it names