Creer v1.2 — HMAC signed peer trust - #14
Draft
seven0070 wants to merge 14 commits into
Draft
Conversation
Scaffold AI repo generation end-to-end: planner/generator API with path validation, TypeScript extension command to write files into the workspace with optional git init, and a PLAN.md for v0.2 priorities. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Backend: curated templates, /plan + /templates, stronger validation, optional GitHub repo create API. Extension: plan preview before write, per-file overwrite protection, GitHub push flow, /creer chat entry and @creer participant, with path-safe writes and shell-safe git exec. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
…rdening Add SSE /generate/stream with per-file progress, OpenAI-compatible base URL and CREER_OFFLINE stubs, LICENSE/CI bake-ins, SecretStorage for GitHub tokens, and GIT_ASKPASS push so tokens never appear on argv or remote URLs. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add stream job_id cancellation, license/CI bake-in options with GET /bakeins, telemetry-free quality gates, and extension AbortSignal progress cancel plus bake-in QuickPicks. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add installable JSON/YAML template packs with /packs API and pack_id planning, extension multi-root workspace picker, and generated-content diff preview before writing files to disk. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add remote pack install/delete and marketplace catalog, side-by-side vscode.diff review for write conflicts, and vsce/ovsx packaging docs so the extension is ready to publish without shipping secrets. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add searchable /registry with JSON pack downloads, extension marketplace icon, Browse Pack Registry command, changelog, and verified vsix packaging path for Marketplace/Open VSX (signing remains a human PAT step). Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add multi-host registry federation via CREER_REGISTRY_PEERS and /registry/federated, Browse Federated Registry in the extension, plus GitHub Actions CI and artifact-first release that publishes only when VSCE_PAT/OVSX_PAT secrets are configured. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add peer status/probe APIs and ad-hoc peers on federated queries, Manage Registry Peers + peer-aware browse UI, GitHub Release assets on tags, and RELEASE.md for the human VSCE/OVSX token publish path. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add optional CREER_REGISTRY_TOKEN for pack/peer write endpoints, gossip-lite /registry/discover with federated discover=true expansion, and extension SecretStorage registry token plus Discover peers UX. Core generate stays public. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add SSRF/private-IP peer guards, allow/deny lists, hop budgets with cycle detection, max_hops on federated queries, and extension trust warnings for private peers plus policy-aware federation status. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
Add shared-secret HMAC signing for registry/discover payloads, trust modes off/optional/required for federated verification, and extension UX for trust status plus optional requireSignedPeers filtering. mTLS remains a human infra option beyond this. Co-authored-by: Sanath S Patil <sanathpatil8861@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements Creer v1.2.0: HMAC signed peer trust (practical shared-secret trust between registries; mTLS remains optional human infra).
Backend
CREER_PEER_TRUST_SECRET+CREER_PEER_TRUST_MODE(off|optional|required)/registryand/registry/discoverpayloads with HMAC-SHA256trustblockpeer_meta.trust_status1.2.0— 64 tests passedExtension
signed/unsigned/ …)creer.requireSignedPeersclient-side filterStill human-only
VSCE_PAT/OVSX_PAT(seeRELEASE.md)Test plan
/health→1.2.0+peer_trust_mode/peer_trust_signing/registryincludes validtrust.sigrequiredmode rejects unsigned peer payloadsoptionalaccepts unsigned; rejects tampered sigsrequireSignedPeersfilters unsigned peer packsRELEASE.md