Repository navigation
feat!: fix the readiness review findings and settle the agent API - #433
Merged
Merged
Conversation
The Analog guide and the glossary still gave the old Vite auth default, JSON samples carried a path comment that broke them when copied, the package README asked for a separate devframe install, the roadmap listed shipped work as planned, and the panel-only devframe host never connected without ws: false. This fixes those pages and the smaller mismatches with the code, and adds the missing exports to the publishing page.
Publishing was a manual step with no provenance and the e2e scripts ran nowhere. A tag now runs the tests, checks the exact tarball with verify:publish and e2e:install, and publishes it with provenance. PRs run the security and MCP checks and a weekly job runs the rest. Each entry point now exports only its documented API, the source scan reads Nx projects, the hub disables itself on an old Node instead of crashing the server, the peer and engine ranges match what is tested, and the leaks-real test expects the rows the collector really reports. Fixes #430
…er pairing Screen readers heard the Timeline, Errors and Audit counts on every push, control outlines and Signals graph edges sat near 1.5:1, and focus fell to the page body once the one-time code was accepted. Counts now speak only after a filter change, controls and edges use new tokens that meet 3:1 in both themes, and pairing moves focus to the active tab with a Connected note. The smaller copy, layout and keyboard fixes from the review come with it, and the extension panel retries on its own.
With two tabs, navigate moved whichever router changed last, failed writes answered isError false, each tool picked a different default page, the DI tools named every signal store SignalStore and the tool list was about 120 KB. Writes now refuse when the page is unclear and mark every failure as an error, one rule picks the default page and every answer names it, signal stores keep their names, failing calls keep their response body, and library tools are listed only for apps that use them, with shorter descriptions.
…oject The 6-digit code could be guessed in about a minute, trusted tokens sat in a world-readable file shared by every server and never expired, allowedHosts true turned off the origin checks, the CLI served MCP with no token, and a static overlay import or a production build without NODE_ENV still exposed devtools. Wrong codes now back off and lock the server after 50 tries, tokens live in a 0600 store per project and expire after 7 days, allowedHosts only adds a same-origin pair with a warning, the CLI asks for the MCP token, and production builds keep the overlay and hub off. Redaction also covers values after separators, XML bodies, more key shapes and TanStack positional data.
… inspector data On zone.js apps the signal history flush and collector timers ran in the Angular zone, so an app that wrote a signal or logged during change detection never settled. One malformed component report broke the agent tools for every page, change detection counted skipped children and the checkNoChanges pass, forms tools answered with another tab's forms, signal graph edges were positions, and a Store provided in a route was not found. Collectors now schedule outside the zone with a real zone.js test, reports are checked at the RPC boundary, checks count only template runs, and the other inspector data is corrected, along with the SSR hydration count and a false transfer cache hit.
A change detection stop now answers once the page confirms it while the summary already shows the recording off, the proxy setup test reads the sample without its old path comment, and the signal graph resource stays within the description limit. The docs list the CLI MCP token, the library tools exception in configuration, and the two new badge variants.
Tool names, argument names and answer shapes freeze at 1.0, and they were inconsistent: page and pageId side by side, selector meaning a component or a CSS selector, get- source scans that read like live tools, library tools with mixed prefixes, and markdown wrapped in JSON. Tools now follow one verb-noun scheme with library prefixes, scan- for source reads, one argument name per concept, and plain text answers. Old names are refused with the new one. The full old to new table is in the changelog. BREAKING CHANGE: agent tools, their arguments and the per-page resource templates are renamed, and answers are plain text instead of a markdown field.
The panel changed in the 1.0 review fixes, and the bundle now carries the third-party license notices.
Lists every change since 0.0.7, with upgrade notes for the changes that can break a setup quietly, the renamed agent tools, the removed exports and the new version ranges. The version itself is bumped in a separate step.
…karound The resilience script still parsed state answers as JSON and read keys that resources now serve, so most of its checks crashed, and two checks had passed without testing anything. The weekly panel job did not turn off the demo's one-time code. On pnpm, the Analog Nitro plugin imports h3 without declaring it and resolves to the h3 2 that devframe brings in, so a new Analog app fails to build once the package is installed. The scripts now read the new answers and resources, the panel job turns the code off, and the Analog guide and install check declare h3 for the plugin with packageExtensions.
New Analog apps on pnpm fail to build with the package installed until h3 is declared for the Nitro plugin.
Contributor
|
Important Review skippedToo many files! This PR contains 401 files, which is 101 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters: 4
📒 Files selected for processing: 401
You can disable this status message by setting the
Comment |
github-actions
Bot
added
area: panel
🚀 Deploying Preview to Cloudflare 🚀Preview Deployments by commit
|
|
View your CI Pipeline Execution ↗ for commit 9f28be1
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
On the CI runner the CLI printed its banner before the socket listened, so every CLI check hit a refused connection. The check now waits until the server answers, and prints the CLI output when it never does.
Some bundled license texts use CRLF line endings. The repo turns text files into LF on checkout, so a fresh build no longer matched the committed file and the stale-bundle check failed. The file is now stored as it is built.
On the CI runner localhost resolves to ::1 first, so the CLI listened on IPv6 only while the checks addressed it as 127.0.0.1. The check now starts the CLI on 127.0.0.1.
Hub messages for agent writes showed only the new page line and posted no-op writes, an ambiguous form id refused a write without isError, arguments that moved to another tool were silently ignored, an Analog navigation timer still ran in the Angular zone, the e2e jobs skipped changes to the demo and the tools docs, and a release could publish a commit whose main CI failed or a tag other than the one it ran from. The feed now reads the answer behind the page line, those refusals carry isError, moved arguments name the tool to use, the timers run outside the zone, CI covers those paths, and a release needs a tag ref and green CI on main. The docs and changelog match.
6 tasks done
erkamyaman
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
main (5a09545) went through a full readiness review in eight areas: security, agent tools, code quality, docs, inspector data, panel and accessibility, package and release, and supported frameworks. This PR fixes every blocker and major finding. It also settles the agent tool names and the public JS API, and adds an unreleased changelog section. The version is not bumped.
Fixes #430. Fixes #424.
Blockers fixed
navigatewith two tabs and nopage. It refuses and lists the pages, and every write names the page it acted on.isError: true. A test sweeps every action tool's refusal paths.Majors fixed, by area
allowedHosts: trueno longer turns off the origin checks;pangular devasks for the MCP token;--root;ws: false);e2e:securityande2e:mcpon PRs;e2e.yml, with hub: a tab that dies without pagehide stays listed for about 150 seconds #422 and forms: the 100-children cap makes explain-form-invalid say no field has an error #423 marked as known failures;Breaking changes (all in the changelog)
scan-for source reads, one argument name per concept, and plain text answers. There are no aliases: old names are refused with the new one.>=12.2.0 <23.0.0, andengines.nodeis>=22.12.0. On an older Node, the hub turns itself off instead of crashing the server.How it was verified
pnpm commit:check(commit messages follow the guidelines)pnpm format:checkpnpm typecheck(includes thengctemplate checks)pnpm test:devtools(3,535 tests) andpnpm test:panel(826 tests)pnpm skills:checkapps/docsupdated andpnpm docs:buildpassespnpm extension:buildandextension/uicommittedpnpm test:axe, 57 views, ande2e-panel, 96 views, 0 problems)End-to-end results on this branch:
pnpm e2e:securitypnpm e2e:mcptools/listis 68 KB (was 122 KB)e2e-resiliencee2e-panele2e:installScreenshots
Before and after screenshots of the changed panel views were taken in both themes at 1280 and 400 px. Controls and graph edges now measure at least 3.04:1 in light and 3.09:1 in dark.
Notes for reviewers
@analogjs/vite-plugin-nitroimportsh3without declaring it, so with this package installed it resolves to h3 2 and the build fails. The Analog guide and the install check declare it withpackageExtensions. An upstream report is drafted.