2 Commits

Include renames

Author	SHA1	Message	Date
3 people	b987464f45	feat(cli): add tool setup command + GitHub setup schema (#438) ... * feat(cli): add `tool setup` command + GitHub setup schema - Add `ironclaw tool setup <name>` CLI command that reads `setup.required_secrets` from a tool's capabilities file and prompts the user for each secret, saving them to the encrypted secrets store. Handles already-configured secrets (ask to replace), optional secrets (skip on empty), and hidden input. - Add `setup.required_secrets` to GitHub tool capabilities file with `github_token` — the only WASM tool that was missing it after PR #437 added setup schemas to all other tools. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * refactor(cli): extract init_secrets_store helper + add tool name validation Address PR review feedback: - Extract duplicated secrets store initialization (~50 lines) from auth_tool and setup_tool into shared init_secrets_store() helper - Add validate_tool_name() to reject path traversal in tool names (applies to both auth_tool and setup_tool) Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>	2026-03-01 06:55:57 +00:00
6 people	61a123a746	Add GitHub tool and Discord channel (#34) ... * Add GitHub tool for IronClaw - manage repos, issues, PRs, and workflows * Add Discord channel for IronClaw - slash commands and button interactions * Security fixes: URL encoding, secret validation, Discord button handler - Add URL encoding for all path segments and query parameters (P1) - Add path segment validation to prevent path traversal - Add secret_exists check for better error messages (P2) - Fix http_request signature to use 5 args (P2) - Fix Discord button handler to check member field (P2) - Fix typo in Discord slash command format (P2) - Add github.capabilities.json and discord.capabilities.json (Blocker) - Add Cargo.toml for Discord channel (Blocker) - Add limit caps (max 100) for all list operations (P3) - Remove debug logging * Apply Copilot review fixes Security & Code Quality: - Use secret_get instead of workspace_read for GitHub token - Remove manual Authorization header (host injects via capabilities) - Add validation for file paths (reject path traversal) - Add validation for workflow_id and git refs - Fix url_encode_query comment - Add release profile optimizations to Cargo.toml files - Fix package names to match conventions (github-tool, discord-channel) - Add metadata fields to Cargo.toml - Fix rate limits to be consistent (60/min, 3600/hr) - Fix Discord user_name to filter empty global_name - Fix Discord metadata serialization error handling - Update Discord README to clarify which secrets are used by host vs WASM - Better formatting for Discord command option values * applied all PR change requests and comments * cleaned up workspace * Adding validation for empty path segments and event enum in GitHub tool * addedvalidation for events and vaidation to reject empty file path in github tools and implemented safe UTF-8 trunacating * added codegen units and updated truncating logic also update capabilities.json as requested by copilot review * added codegen units and updated truncating logic also update capabilities.json as requested by copilot review * fixed message trucating and remove url_encode alias, also appled all requested changes from last PR comment --------- Co-authored-by: root <root@cafx> Co-authored-by: Peni <[email protected]> Co-authored-by: Illia Polosukhin <[email protected]> Co-authored-by: firat.sertgoz <[email protected]>	2026-02-16 15:58:13 +04:00