feat: add Cap for Agents page and nav tab - #2270
Merged
Merged
Conversation
| Set up Cap: | ||
| 1. Identify my operating system and the agent you are running in. Select only the current agent; never install into every detected agent. | ||
| 2. Run cap version --json. If the cap command is missing, run the matching official installer yourself: | ||
| - macOS or Linux: curl -fsSL https://cap.so/install-cli.sh | sh |
There was a problem hiding this comment.
P1: The agent setup prompt executes an unverified remote installer
The new agent prompt executes a network-fetched installer without integrity verification.
Use a versioned, signed installer and verify its checksum before execution.
AI prompt
Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.
<file name="apps/web/data/agent-prompt.ts">
<violation number="1" location="apps/web/data/agent-prompt.ts:21">
<priority>P1</priority>
<title>The agent setup prompt executes an unverified remote installer</title>
<evidence>The newly published agent-facing operating instructions tell an agent to fetch a shell installer over HTTPS and execute it directly when the CLI is missing. The downloaded script is not pinned, checksum-verified, or otherwise inspected before execution, so compromise or replacement of the endpoint would become arbitrary code execution on the user's machine.</evidence>
<recommendation>Replace the pipe-to-shell and PowerShell expression execution with a versioned installer artifact whose signature or SHA-256 is verified before execution. Prefer directing the user to an independently verified installation flow, and document the exact version and integrity value.</recommendation>
</violation>
</file>
Member
Author
|
hey @greptileai, please re-review the PR |
Member
Author
|
hey @greptileai, please re-review the PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
/agents, a marketing page for using Cap entirely from an AI agent, and an Agents tab in the site nav.The page is built in the HomeTwo design language (Instrument Sans / Source Serif / DM Mono, cream card, grain, mode meshes, flat header + island) and reuses the existing agent scene from the homepage.
Sections
cap.so/agentspointer pill, the harness list, and the existingAGENTscene in the dark card.data/agent-prompt.ts) in a collapsible terminal card, three HowTo steps, and a "Point your agent here" card with a one-line prompt that tells an agent to read this page.cap agents installcommands, the OpenCode MCP entry, generic stdio config, what gets installed, and read-only verification commands. Every snippet has a copy button.prefers-reduced-motion.CAP_API_KEYnote.SEO
Screen Recorder for AI Agents | Cap for Agents, description, keywords, canonical, OG/Twitter viabuildMarketingMetadata(signed/api/ogimage verified)./agents;llms.txt/llms-full.txtpoint agents at the page./agentsis picked up by the sitemap automatically.Other changes
CAP_AGENT_PROMPTmoved toapps/web/data/agent-prompt.tsand re-exported from the docsCopyablePromptso both surfaces share one source of truth.HomeTwo/scenes/AgentScene.tsx: unbroken JSON output in the tool rows overflowed the viewport at phone widths (homepage too);overflow-wrap: anywhereon the output container fixes it.Validation
ids use the samebiome-ignorepattern asWorkflow.tsx/ModeWalkthrough.tsx.tsc --noEmitforapps/web: no errors in touched files (the 30 pre-existing errors are in untouched files such asworkflows/edit-video.ts).__tests__/unit/agent-docs.test.ts: 14/14 pass.next start:/agentsserves in production mode with all of the above passing at 1440 and 390 and zero console errors. A fullnext buildcurrently dies on the pre-existinguseContextprerender flake on/admin/reprocess-videoand/messenger(neither touches these files), so static prerender of the route could not be confirmed locally.The PR appears safe to merge; the previously reported contract, analytics, and lint-suppression issues are resolved.
Summary
Reviews (3) · Last reviewed commit: "fix: show the real operation, context, a..."