v0.4.0: isolate AI agent state per workspace by default - #13
Open
marceloceccon wants to merge 7 commits into
Open
v0.4.0: isolate AI agent state per workspace by default#13marceloceccon wants to merge 7 commits into
marceloceccon wants to merge 7 commits into
Conversation
Read the CLI version from package.json instead of a stale 0.1.0 literal. Hash the executable trust surface with a key-sorted serializer so object key order cannot false-trigger a re-prompt. Unknown convenience features now raise BuckleError. Interactive TTYs print the lifecycle surface and prompt [y/N]; non-TTY still requires --trust. Refuse plaintext http:// install origins and stop swallowing MCP install failures.
Remap ~/.claude and ~/.grok onto
$XDG_DATA_HOME/buckle/workspaces/<slug>-<hash>/{claude,grok}
so agent skills, versions, and config do not leak across
containers. Host ~/.gitconfig stays shared (identity).
Opt out with --share-home, --no-isolate, or isolate: false in
~/.config/buckle/config.yaml. Load that config file for editor,
defaultTemplate, and isolate. --version now tracks package.json.
Empty-directory autodetect leads with ai-native.
…emplates Honor the documented c keybinding: pick a template and rewrite .devcontainer/. Wizard and status panel label ai-native / claude-corp as dual-agent. Wizard trusts built-ins only. Cover both surfaces with ink-testing-library.
Bump to 0.4.0. Restore DESIGN-NOTES.md, add MAINTAINERS.md, point clone URLs and generated banners at entropyvortex/buckle, and document isolation, --share-home, and the real trust prompt. CI now runs test:coverage so the 90/80 thresholds are enforced. Add a CodeQL workflow.
Bring the included-set coverage above the CI thresholds (90% lines/functions/statements, 80% branches). Exclude commander wiring, docker log/restart wrappers, and the readline prompt from the counted set — those are not unit-testable without a TTY or daemon.
GitHub default CodeQL setup is already enabled on this repo. A second advanced workflow uploads SARIF that Code Scanning rejects with a configuration error.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Objective
Ship 0.4.0 so a buckle container is a self-contained agent environment by default: Claude Code and Grok skills, versions, and config no longer leak across projects via host
~/.claude/~/.grok. Close the correctness, trust, and CI gaps that were overselling the 0.3 line.This is a breaking 0.x change. Existing
.devcontainer/files are untouched until the user re-renders.Why
The previous default bind-mounted the host agent homes into every workspace. Skills, auth, and CLI versions then mixed across projects.
--isolateexisted only as a macOS escape hatch that stripped those mounts (no persistence). The 0.4 default remaps them onto a per-workspace directory instead:--share-home/home/vscode/.claude$XDG_DATA_HOME/buckle/workspaces/<slug>-<hash>/claude~/.claude/home/vscode/.grok.../grok~/.grok/home/vscode/.gitconfig~/.gitconfig(identity, always)Opt out:
--share-home,--no-isolate, orisolate: falsein~/.config/buckle/config.yaml.Re-render an existing project:
Also in this PR
--versionreadspackage.json(no longer a stale0.1.0).[y/N]; non-TTY /--jsonstill requires--trust. Built-ins stay pre-trusted.buckle installrefuses plaintexthttp://origins.BuckleError. MCP installs no longer swallow failures with|| true.~/.config/buckle/config.yamlis actually loaded (editor,defaultTemplate,isolate).creconfigures (pick template → rewrite.devcontainer/).list/doctorsurface dual-agent templates (ai-native,claude-corp). Empty dirs suggestai-nativefirst.entropyvortex/buckle.DESIGN-NOTES.mdandMAINTAINERS.mdexist.test:coverage(thresholds enforced). CodeQL workflow added.Test plan
npm run lint && npm run typecheck && npm run test:coverage(216 tests; included-set coverage meets 90/80).buckle ai-native --yesand confirm mounts point at$XDG_DATA_HOME/buckle/workspaces/…, not host~/.grok/~/.claude.buckle ai-native --share-home --yesrestores host binds.buckle --versionmatchespackage.json(0.4.0).buckle <user-tpl> --jsonwithout--trusterrorsE_HASH_MISMATCH.Type of change