Repository navigation
chore: keep agent working files out of the public repository - #376
Merged
Merged
Conversation
bun audit reported two high advisories, which failed `just check` and blocked every push. Upgrade happy-dom to 21.0.4 (GHSA-834v-8h66-3h79 affects up to 21.0.3) and zod 4 to 4.6.6 (GHSA-mrhx-c7xc-m3w5), and rebuild the embedded UI and THIRD_PARTY_NOTICES for the new zod. The zod advisory remains in the zod 3 copy that @ag-ui/client and @ag-ui/proto require, and zod 3 has no patched release. In the browser it parses events from Fanout's own authenticated /api/agent/runs, so the worst case is the user's own tab running out of memory. ui-audit ignores it with that rationale until AG-UI moves to zod 4.6.6 or later.
Agent implementation plans and browser verification records are local working material, not project documentation. Remove the plans under docs/superpowers/plans and the milestone 1-4 dashboard verification records under docs/benchmarks. Move the three design specs to docs/specs so the reviewed design history stays without a tool-named directory, and keep them out of the context7 index. Ignore .claude/ in Git as .dockerignore already does, and add a gitleaks configuration that extends the default rules with an allowlist for the known non-secrets: the fixed test auth code secret, a redaction fixture, a cache key name, and content hashes in UI fixtures and the retired Atlas checksum file. A full history scan now reports no findings.
The DuckDB 2 review and follow-up records and the single-port measurements are internal verification material; nothing in the product or site links to them, and published performance claims cite fanout-bench. Remove docs/benchmarks, point docs/testing.md at verification records kept outside the repository, and drop the folder from the context7 excludes.
Read benchmarks, the dead-code gate tests and the dashboard eval harness kept scratch output under .superpowers/, a private agent workspace. Move it under the ignored .cache/ directory, which the DuckDB wrapper already uses. Remove the two tests that only checked private tooling and always skipped without it: scripts/collector-import.test.ts and the build-audit case in scripts/ui-compare.test.ts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #375, which unblocks
just check. GitHub retargets this tomainwhen #375 merges.What changed
docs/superpowers/plans/, 7 files) and the milestone 1–4 dashboard browser verification records (docs/benchmarks/2026-10-agent-dashboards-m1..m4.md). These are local working material, and AGENTS.md already keeps evaluation records and browser evidence out of Git.docs/superpowers/specs/todocs/specs/, and keptdocs/specsout of the context7 index as the old path was. One spec sentence pointed at a verification record that never existed; it now says the records stay outside the repository..gitignorenow ignores.claude/, matching.dockerignore..gitleaks.toml: default rules plus an allowlist for known non-secrets (the fixed test auth code secret, a redaction fixture, theedge_rollup_v2_rawmaxcache key name, and content hashes in UI fixtures and the retiredatlas.sum). The 28 history findings were all of these.docs/benchmarks/(DuckDB 2 review and follow-up records, single-port measurements). Nothing links to them and published performance claims cite fanout-bench.docs/testing.mdnow keeps milestone measurements with verification records outside the repository;context7.jsondrops the folder..superpowers/workspace: read-benchmark scratch, the dead-code gate testGOCACHE, and the dashboard eval harness output (.cache/dashboard-eval/) now use the ignored.cache/. Removedscripts/collector-import.test.tsand the build-audit case inscripts/ui-compare.test.ts, which only checked private tooling and always skipped without it.No product code, API, configuration, or release-contract change. History is not rewritten; the removed files contain no secrets.
Verification
just check: all checks passed (pre-push hook).gitleaks git .over full history: no leaks.