Skip to content

test - #122

Closed
wkoutre wants to merge 91 commits into
mainfrom
test-merge
Closed

test#122
wkoutre wants to merge 91 commits into
mainfrom
test-merge

Conversation

@wkoutre

@wkoutre wkoutre commented Oct 29, 2025

Copy link
Copy Markdown
Contributor

No description provided.

wkoutre and others added 30 commits October 9, 2025 13:47
- Updated README.md to recommend sonnet-4.5 as the preferred model for new agents.
- Changed model references in commit-message-generator.md and pr-creator.md to sonnet-4.5.
- Modified schema.d.ts and schema.json to include sonnet-4.5 as an option for agent models.
- Updated README.md to recommend sonnet-4.5 as the preferred model for new agents.
- Changed model references in commit-message-generator.md and pr-creator.md to sonnet-4.5.
- Modified schema.d.ts and schema.json to include sonnet-4.5 as an option for agent models.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.0

- project: @ai-toolkit/utils 0.2.10-next.0

- project: @ai-toolkit/agents-agnostic 0.2.10-next.0

- project: @ai-toolkit/commands-agnostic 0.1.14-next.0

- project: @ai-toolkit/commands-typescript 0.1.11-next.0
- Updated README.md to recommend sonnet-4.5 as the preferred model for new agents.
- Changed model references in commit-message-generator.md and pr-creator.md to sonnet-4.5.
- Modified schema.d.ts and schema.json to include sonnet-4.5 as an option for agent models.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.1

- project: @ai-toolkit/utils 0.2.10-next.1

- project: @ai-toolkit/agents-agnostic 0.2.10-next.1

- project: @ai-toolkit/commands-agnostic 0.1.14-next.1

- project: @ai-toolkit/commands-typescript 0.1.11-next.1
#73)

* Improve the claude docs agents by adding a fact-checker subagent that verifies the output of other claude doc agents

Completes DEV-107

sub-commits:

add initial plan

implement plan for updating claude-docs to use fact-checker and batched approvals

* add model prompt parameter to several subagents
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.2

- project: @ai-toolkit/utils 0.2.10-next.2

- project: @ai-toolkit/agents-agnostic 0.2.10-next.2

- project: @ai-toolkit/commands-agnostic 0.1.14-next.2

- project: @ai-toolkit/commands-typescript 0.1.11-next.2
…mation for git commits at logical completion points (#72)

* improvement: update execute-plan documentation to require user confirmation for git commits at logical completion points

* improvement: require user confirmation before creating git commits in various workflows
…timize deployment process (#75)

### TL;DR

Added an ignore command to the Vercel configuration for the Slack OAuth backend to skip deployments when the project is not affected.

### What changed?

Added an `ignoreCommand` to the `vercel.json` file that uses the Nx affected projects detection to determine if the `slack-oauth-backend` project was modified between the previous and current commit. If the project wasn't affected, the deployment will be skipped.

### How to test?

1. Make a change to a different project in the monorepo
2. Verify that the Slack OAuth backend doesn't deploy on Vercel
3. Make a change to the Slack OAuth backend
4. Verify that the deployment proceeds as expected

### Why make this change?

This optimization prevents unnecessary deployments of the Slack OAuth backend when changes are made to unrelated parts of the codebase. This will save deployment resources and time by only triggering deployments when the project is actually affected by changes.
… Slack notifications (#76)

### Summary of Changes
- Updated the production update workflow to generate a categorized changelog based on commit types (features, fixes, documentation, maintenance, and others).
- Added Slack notifications for both successful PR creation and merge conflicts.
- Improved workflow documentation to clarify required secrets and behavior.
- Assigned specific reviewers to the PR and included detailed next steps in the summary.

### Why This Change?
These enhancements streamline the release process, improve communication with the team, and ensure that the changelog is informative and well-structured for easier review.
### Summary of Changes
- Replaced single quotes with double quotes for consistency in the `publish-packages.yml` file.
- Removed the NPM authentication verification step that was conditional on the dry run input.

### Why This Change?
These adjustments improve the readability of the workflow file and streamline the publishing process by eliminating unnecessary checks.
…78)

### Summary of Changes
- Deleted `always-auth` and `_authToken` entries from `.npmrc`.
- Removed `NODE_AUTH_TOKEN` references from the GitHub Actions workflow and documentation.

### Why This Change?
These modifications streamline the configuration by eliminating unnecessary authentication steps, enhancing clarity and security in the publishing process.
…ion flow (#71)

* feat: enhance addon installation process and conditional prompting

- Added support for installing all MCP servers at once or a specific one via new `installMode` option.
- Updated generator logic to handle installation modes and provide detailed installation summaries.
- Introduced critical rules for conditional prompting in Nx generator schemas to improve user experience.
- Expanded addon registry with new MCP servers including Graphite, Nx, Slack, and others.
- Enhanced documentation for MCP authentication instructions and setup guidance.

* get notion mcp addon working

This required changing the AddonMetadata interface to support a new non-command based way of adding mcps to claude

---------

Co-authored-by: Melvillian <alex.melville@uniswap.org>
### TL;DR

Updated MCP configuration for Figma and Vercel addons to use the new transport/url pattern.

### What changed?

Modified the addon registry configuration for Figma and Vercel addons:
- Renamed `command` to `transport` in both addon configurations
- Renamed `args` array to `url` string property
- Preserved the actual transport types and URLs

### How to test?

1. Verify that the Figma addon connects properly using SSE transport to `http://127.0.0.1:3845/mcp`
2. Verify that the Vercel addon connects properly using HTTP transport to `https://mcp.vercel.com`

### Why make this change?

This change standardizes the MCP configuration pattern by using more descriptive property names (`transport` instead of `command`, `url` instead of an array of arguments). This improves code readability and makes the configuration more intuitive while maintaining the same functionality.
- Removed Bun-related configurations and commands throughout the project.
- Updated all instances of `bunx` to `npx` in scripts, documentation, and configuration files.
- Deleted `bun.lock` and `bun.lockb` files, replacing them with `package-lock.json`.
- Adjusted CI/CD workflows to utilize npm commands for dependency installation and package management.
- Enhanced documentation to reflect the changes in package management and installation processes.

This transition aims to streamline the development workflow and improve compatibility across environments.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.3

- project: @ai-toolkit/utils 0.2.10-next.3

- project: @ai-toolkit/agents-agnostic 0.2.10-next.3

- project: @ai-toolkit/commands-agnostic 0.1.14-next.3

- project: @ai-toolkit/commands-typescript 0.1.11-next.3
#79)

### Summary of Changes
- Introduced a new command `daily-standup` that checks assigned Linear tasks and generates a team update.
- Documented the workflow process, execution steps, usage examples, and output format in `daily-standup.md`.
- Updated `index.ts` to include the new command with a brief description.

### Why This Change?
This addition enhances team communication by providing a structured update on ongoing tasks and recent GitHub activity, facilitating better collaboration during daily standups.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.4

- project: @ai-toolkit/utils 0.2.10-next.4

- project: @ai-toolkit/agents-agnostic 0.2.10-next.4

- project: @ai-toolkit/commands-agnostic 0.1.14-next.4

- project: @ai-toolkit/commands-typescript 0.1.11-next.4
- Implemented a new step in the GitHub Actions workflow to send a Slack notification when packages are published from the `next` branch.
- The notification includes details about the published packages, the commit SHA, and a link to the workflow run.
- This enhancement aims to improve communication and visibility for team members regarding package releases.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.5

- project: @ai-toolkit/utils 0.2.10-next.5

- project: @ai-toolkit/agents-agnostic 0.2.10-next.5

- project: @ai-toolkit/commands-agnostic 0.1.14-next.5

- project: @ai-toolkit/commands-typescript 0.1.11-next.5
…#89)

- Updated the Slack notification step in the GitHub Actions workflow to build the JSON payload in a temporary file, enhancing readability and maintainability.
- Added error handling for the Slack notification to ensure the workflow continues even if the notification fails.
- Escaped package names in the notification to prevent JSON formatting issues.
- Improved debugging output by displaying the HTTP status and response from the Slack API.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.6

- project: @ai-toolkit/utils 0.2.10-next.6

- project: @ai-toolkit/agents-agnostic 0.2.10-next.6

- project: @ai-toolkit/commands-agnostic 0.1.14-next.6

- project: @ai-toolkit/commands-typescript 0.1.11-next.6
* chore(ci): Add pre checks

* Fix

* chore: regenerate package-lock.json with Node.js 22.21.0

- Regenerated lockfile using Node.js v22.21.0 (npm 10.9.4) to match CI environment
- Fixes dependency resolution and hoisting differences
- Ensures CI package-lock.json validation check passes

* Align node versions

* base branch fix
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.7

- project: @ai-toolkit/utils 0.2.10-next.7

- project: @ai-toolkit/agents-agnostic 0.2.10-next.7

- project: @ai-toolkit/commands-agnostic 0.1.14-next.7

- project: @ai-toolkit/commands-typescript 0.1.11-next.7
#90)

- Updated the CLI generator to provide a clearer distinction between external and internal usage.
- External users now default to the init generator when no arguments are provided, while internal users can access an interactive menu for all generators.
- Enhanced documentation within the code to clarify usage scenarios and improve developer experience.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.8

- project: @ai-toolkit/utils 0.2.10-next.8

- project: @ai-toolkit/agents-agnostic 0.2.10-next.8

- project: @ai-toolkit/commands-agnostic 0.1.14-next.8

- project: @ai-toolkit/commands-typescript 0.1.11-next.8
github-actions Bot and others added 15 commits October 28, 2025 16:51
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.3

- project: @ai-toolkit/utils 0.2.10-next.3

- project: @ai-toolkit/agents-agnostic 0.2.10-next.3

- project: @ai-toolkit/commands-agnostic 0.1.14-next.3

- project: @ai-toolkit/commands-typescript 0.1.11-next.3
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.4

- project: @ai-toolkit/utils 0.2.10-next.4

- project: @ai-toolkit/agents-agnostic 0.2.10-next.4

- project: @ai-toolkit/commands-agnostic 0.1.14-next.4

- project: @ai-toolkit/commands-typescript 0.1.11-next.4
- Implemented a new step in the GitHub Actions workflow to send a Slack notification when packages are published from the `next` branch.
- The notification includes details about the published packages, the commit SHA, and a link to the workflow run.
- This enhancement aims to improve communication and visibility for team members regarding package releases.
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.5

- project: @ai-toolkit/utils 0.2.10-next.5

- project: @ai-toolkit/agents-agnostic 0.2.10-next.5

- project: @ai-toolkit/commands-agnostic 0.1.14-next.5

- project: @ai-toolkit/commands-typescript 0.1.11-next.5
- project: @uniswap/ai-toolkit-nx-claude 0.5.10-next.6

- project: @ai-toolkit/utils 0.2.10-next.6

- project: @ai-toolkit/agents-agnostic 0.2.10-next.6

- project: @ai-toolkit/commands-agnostic 0.1.14-next.6

- project: @ai-toolkit/commands-typescript 0.1.11-next.6
* chore(ci): Add pre checks

* Fix

* chore: regenerate package-lock.json with Node.js 22.21.0

- Regenerated lockfile using Node.js v22.21.0 (npm 10.9.4) to match CI environment
- Fixes dependency resolution and hoisting differences
- Ensures CI package-lock.json validation check passes

* Align node versions

* base branch fix
…ation (#93)

- Refactored the GitHub Actions workflow to enhance the changelog generation process.
- Changed the handling of the dry run input description and default values to use consistent quotation marks.
- Updated the logic to retrieve git diffs and commit messages for better context in changelog generation.
- Implemented a fallback mechanism to generate a changelog from commits if AI generation fails.
- Improved Slack notification formatting to include commit range and package details.
- Updated the GitHub Actions workflow to build only changed packages instead of all packages.
- Enhanced the changelog generation prompt to specify formatting requirements for Slack, including bullet points and text styling.
chore(workflow): refine build process and changelog prompt

- Updated the GitHub Actions workflow to build only changed packages instead of all packages.
- Enhanced the changelog generation prompt to specify formatting requirements for Slack, including bullet points and text styling.

chore(nx.json): add custom commit message for releases

- Introduced a custom commit message format for releases to streamline the publishing process.
…cy management (#96)

- Updated nx.json to simplify versioning configuration by removing redundant git settings and enhancing the commit message format for releases.
- Modified package-lock.json to replace 'dev' with 'devOptional' for several dependencies, improving clarity on optional development dependencies.
- Reintroduced git settings for commit and tag options within the versioning and changelog sections of nx.json to ensure proper handling during releases.
@wkoutre
wkoutre requested a review from a team as a code owner October 29, 2025 00:05
@vercel

vercel Bot commented Oct 29, 2025

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
ai-toolkit-slack-oauth-backend Error Error Oct 29, 2025 0:08am

@graphite-app
graphite-app Bot requested a review from Melvillian October 29, 2025 00:06
scope: "@uniswap"

- name: Install npm
run: npm install -g npm@10.9.2

@semgrep-code-uniswap semgrep-code-uniswap Bot Oct 29, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

🎉 Removed in commit 2834a19 🎉

fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.

You can view more details about this finding in the Semgrep AppSec Platform.

- uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

- name: Checkout repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.

You can view more details about this finding in the Semgrep AppSec Platform.

- uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
First step in each job must use bullfrogsec/bullfrog, unless the job is on macOS.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by gh-actions-first-step-must-be-bullfrogsec.

You can view more details about this finding in the Semgrep AppSec Platform.

Comment on lines +168 to +178
run: |
if [[ "${{ inputs.branch }}" == "next" ]]; then
echo "emoji=📦" >> $GITHUB_OUTPUT
echo "title=Next Branch Packages Published" >> $GITHUB_OUTPUT
echo "description=Packages from the \`next\` branch have been published to npm with the \`next\` tag." >> $GITHUB_OUTPUT
else
echo "emoji=🚀" >> $GITHUB_OUTPUT
echo "title=Production Packages Published" >> $GITHUB_OUTPUT
echo "description=Packages from the \`main\` branch have been published to npm with the \`latest\` tag." >> $GITHUB_OUTPUT
fi

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified a blocking 🔴 issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

You can view more details about this finding in the Semgrep AppSec Platform.

@semgrep-code-uniswap

Copy link
Copy Markdown

Semgrep found 1 npm-package-in-action-not-pinned-to-commit-sha finding:

  • .github/workflows/publish-packages.yml

$...LIB
An npm script inside an action on GitHub is not pinned to a full length commit SHA. Pinning the npm package to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

Comment on lines +53 to +80
run: |
# Get the commit range for this push
BEFORE_SHA="${{ inputs.before_sha }}"
AFTER_SHA="${{ inputs.after_sha }}"

echo "Comparing commits: $BEFORE_SHA...$AFTER_SHA"

# Get the diff with file changes and commit messages
DIFF_OUTPUT=$(git diff --stat "$BEFORE_SHA...$AFTER_SHA")
COMMIT_MESSAGES=$(git log --pretty=format:"- %s (%h)" "$BEFORE_SHA..$AFTER_SHA")

# Combine into a single output for the AI
FULL_CONTEXT="## Commits in this push:
$COMMIT_MESSAGES

## Files changed:
$DIFF_OUTPUT"

# Save to output using heredoc
{
echo 'context<<EOF'
echo "$FULL_CONTEXT"
echo 'EOF'
} >> $GITHUB_OUTPUT

echo "before_sha=$BEFORE_SHA" >> $GITHUB_OUTPUT
echo "after_sha=$AFTER_SHA" >> $GITHUB_OUTPUT

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified a blocking 🔴 issue in your code:
Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by run-shell-injection.

You can view more details about this finding in the Semgrep AppSec Platform.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​ai-toolkit/​commands-agnostic@​0.1.15 ⏵ 0.1.14-next.6100100100100100
Updated@​ai-toolkit/​utils@​0.2.11 ⏵ 0.2.10-next.6100100100100100
Updated@​ai-toolkit/​agents-agnostic@​0.2.11 ⏵ 0.2.10-next.6100100100100100

View full report

@wkoutre wkoutre closed this Oct 29, 2025
@wkoutre
wkoutre deleted the test-merge branch November 6, 2025 23:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants