Coding-agent surfaces: kit HTML and choices kinds, CLI, self-hosted hardening, token bench - #108

Open

baanish wants to merge 32 commits into

mainfrom

coding-agent-optimization

Commits on Jul 31, 2026

viewer: kit html and choices artifact kinds

baanish
and
claude
committed
selfhosted: 7-day default TTL, env override, optional password gate

baanish
and
claude
committed
cli: @agent-render/cli workspace with create command

baanish
and
claude
committed
bench: measure fragment codecs in tokens, not chars

baanish
and
claude
committed
integration: cli html/choices kinds, workspace lockfile, bench report into docs

baanish
and
claude
committed
build: root typecheck excludes cli workspace and runs its own tsc

baanish
and
claude
committed
selfhosted: derive auth key via scrypt, gate Secure cookie on TLS

baanish
and
claude
committed
harden kit html and self-hosted auth after review

baanish
and
claude
committed
bound choices payloads, guard CLI size, fix review doc/CI gaps

baanish
and
claude
committed
fix trust-drop race and sanitizer stack overflow

baanish
and
claude
committed
selfhosted: fail fast on unusable config, decouple cookie from password

baanish
and
claude
committed
enforce choices caps at encode time, harden CLI edge cases

baanish
and
claude
committed
align docs with the shipped behavior

baanish
and
claude
committed
ignore local planning docs

baanish
and
claude
committed
keep tuple codecs away from html payloads

baanish
and
claude
committed
replace the choices artifact kind with a kit component

baanish
and
claude
committed
correct the homepage kind count and pin the ar-choices contract

baanish
and
claude
committed
fix the ar-choices example to match its own options

baanish
and
claude
committed
tighten the trusted sandbox, href parsing, and forwarded-proto trust

baanish
and
claude
committed
rate-limit failed auth attempts before the KDF

baanish
and
claude
committed
regenerate the skill discovery digests and guard them

baanish
and
claude
committed
stop the CLI sending one instance's token to another host

baanish
and
claude
committed
fail closed on an empty password, and stop caching authenticated responses

baanish
and
claude
committed
render the ar-choices detail line under its label

baanish
and
claude
committed
key auth rate limiting per client, not per proxy

baanish
and
claude
committed
serve trusted HTML from an isolated frame with its own CSP

baanish
and
claude
committed
actually stop the CLI leaking a token across instances

baanish
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Coding-agent surfaces: kit HTML and choices kinds, CLI, self-hosted hardening, token bench - #108

Coding-agent surfaces: kit HTML and choices kinds, CLI, self-hosted hardening, token bench#108
baanish wants to merge 32 commits into
mainfrom
coding-agent-optimization

Commits on Jul 31, 2026

viewer: kit html and choices artifact kinds

selfhosted: 7-day default TTL, env override, optional password gate

cli: @agent-render/cli workspace with create command

bench: measure fragment codecs in tokens, not chars

integration: cli html/choices kinds, workspace lockfile, bench report into docs

build: root typecheck excludes cli workspace and runs its own tsc

selfhosted: derive auth key via scrypt, gate Secure cookie on TLS

harden kit html and self-hosted auth after review

bound choices payloads, guard CLI size, fix review doc/CI gaps

fix trust-drop race and sanitizer stack overflow

selfhosted: fail fast on unusable config, decouple cookie from password

enforce choices caps at encode time, harden CLI edge cases

align docs with the shipped behavior

ignore local planning docs

keep tuple codecs away from html payloads

replace the choices artifact kind with a kit component

correct the homepage kind count and pin the ar-choices contract

fix the ar-choices example to match its own options

tighten the trusted sandbox, href parsing, and forwarded-proto trust

rate-limit failed auth attempts before the KDF

regenerate the skill discovery digests and guard them

stop the CLI sending one instance's token to another host

fail closed on an empty password, and stop caching authenticated responses

render the ar-choices detail line under its label

key auth rate limiting per client, not per proxy

serve trusted HTML from an isolated frame with its own CSP

actually stop the CLI leaking a token across instances

Commits on Aug 1, 2026

close the image beacon channel in the frame CSP

bind stored tokens to their stored endpoint, decode input strictly

count in-flight derivations against the auth rate limit

stop claiming the isolation frame prevents exfiltration

bind every layer's token to the endpoint it names