- Use full agent path (claude.exe) on Windows to avoid shell:true
which breaks stdin piping for stream-json input mode
- Fix SSH condition to check enabled flag, not just config existence
- Pass sessionSshRemoteConfig through inline wizard to enable remote execution
- Add synopsis SSH inheritance from parent session as backend workaround
Fixes local wizard crashing with exit code 1 and SSH sessions
incorrectly using local paths when SSH was disabled.
- Added Python 3.11 to Windows CI to restore distutils support required by node-gyp
- Ensured native module rebuilds (better-sqlite3, node-pty) succeed on Windows runners
- Fixed TypeScript build errors to restore clean compilation across all platforms
- Added extensive DEBUG-level logging for SSH command execution, spawn details, exit codes, and configuration flow
- Improved Wizard SSH remote support:
- Debounced remote directory validation to reduce excessive SSH calls
- Fixed git.isRepo() to correctly pass remoteCwd for remote checks
- Persisted SSH config in SerializableWizardState and validated directories over SSH
- Ensured ConversationScreen and ConversationSession consistently pass SSH config for remote agent execution
- Fixed "agent not available" errors by forwarding stdin via exec and enabling stream-json mode for large prompts
- Enhanced remote agent execution logic in ProcessManager with stdin streaming, exec-based forwarding, and useStdin flag
- Improved SSH file browser behavior:
- Added resolveSshPath() to locate SSH binaries on Windows (Electron spawn PATH issue)
- Corrected getSshContext() handling of enabled/remoteId states
- Ensured synopsis background tasks run via SSH instead of local paths
- Added Windows development improvements: dev:win script and PowerShell launcher for separate renderer/main terminals
- Added additional SSH directory debugging logs for remote-fs and wizard flows
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Added full SSH remote support to the wizard, including propagation of SSH config through all phases
- Ensured SSH config flows correctly through IPC bridge (renderer → preload → main)
- Improved agent detection with optional sshRemoteId and remote `which` resolution
- Fixed SSH config transfer during manual agent creation and auto-selection flows
- Added extensive debugging and structured logging for SSH execution, agent availability, and wizard message flow
- Improved stdin/JSON streaming for large prompts and remote execution
- Added input/output JSON stream handling and enhanced logging for SSH transport
- Added sourcing of bash profiles to correctly resolve claude-code binary paths on remote hosts
## CHANGES
- Extract dev server port and URL into separate variables
- Add radix parameter to `parseInt` for proper number parsing
- Sync port configuration between Vite config and main process
- Use consistent port parsing with explicit base 10 radix
- Use module-level flag instead of try-catch for IPC handler registration
- Improve error logging to capture full context with stack traces
- Add race condition protection for quit confirmation flow
Extract app lifecycle functionality into dedicated modules with dependency
injection pattern for improved testability and maintainability:
- error-handlers.ts: Global uncaught exception and unhandled rejection handlers
- cli-watcher.ts: CLI activity file watcher with start/stop lifecycle
- window-manager.ts: Window creation with state persistence and auto-updater
- quit-handler.ts: Quit confirmation flow and cleanup orchestration
This reduces main/index.ts by ~200 lines and adds 48 new tests covering
all extracted functionality.
- Add MAX_GROUP_CHAT_BUFFER_SIZE (10MB) to prevent memory exhaustion
- Add buffer truncation with marker when exceeding limit
- Add isGroupChatBufferTruncated() to check truncation status
- Add debugLogLazy() for lazy evaluation of expensive string operations
- Use proper TypeScript types (StoredSession, Group) in web-server-factory
- Add 15 new tests for buffer limits and lazy logging
1 - Pure function extractions:
- constants.ts: Add regex patterns and debugLog for group chat
- group-chat/session-parser.ts: parseParticipantSessionId
- group-chat/output-parser.ts: Text extraction from agent JSONL output
- group-chat/output-buffer.ts: Streaming output buffer management
2 - Dependency injection factories:
- utils/safe-send.ts: createSafeSend for safe IPC messaging
- web-server/web-server-factory.ts: createWebServerFactory for web server
Added 133 new unit tests across 6 test files for full coverage of
extracted modules.
* docs: add git hash display and configurable dev server port
## CHANGES
- Add `VITE_PORT` env variable to configure dev server port
- Display git commit hash in About modal next to version
- Add `__GIT_HASH__` build-time constant to both Vite configs
- Document running multiple Maestro instances with git worktrees
- Update CONTRIBUTING.md with parallel development instructions
* feat: add configurable ports for dev servers
- Allow VITE_PORT to configure main dev server port
- Update main window to load from configurable port
- Enable VITE_WEB_PORT for web interface dev server
- Add note in CONTRIBUTING.md about port configuration
- Log port usage in development mode
* docs: update CONTRIBUTING.md section and fix React DevTools script initialization
## CHANGES
- Rename "Linting" section to "Linting & Pre-commit Hooks" in table of contents
- Move script variable declaration outside conditional block
- Fix React DevTools script initialization order in index.html
* chore: update `.vscode/settings.json` with new markdownlint config
* fix: disable biome linting. Project uses ESLint
* chore: Update baseline-browser-mapping (>2 months old, warning message on "npm run build:web")
* chore: add .vscode/ to gitignore
* chore: fix gitignore to ignore .cscode/* files properly
* fix
* chore: stop tracking .vscode/ files, respect gitignore
Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
- Add merged manifest lookup for local playbook imports
- Read local manifest and merge with official during import
- Display "Local" badge for custom playbooks in marketplace UI
- Add source badge in playbook detail view sidebar
- Support filesystem paths (absolute and tilde) for local playbooks
- Add comprehensive tests for local playbook import scenarios
- Add tests for merged manifest lookup and source tagging
- Fix mock file reads to handle local manifest ENOENT cases
- Agent Usage chart now tracks Maestro sessions, not providers 🎯
- Map session IDs to friendly names in charts and legends 🏷️
- Limit Agent Usage chart to top 10 sessions by queries 🔟
- Toggle Agent Usage chart between query counts and time metrics ⏱️
- Auto Run queries now record stats with accurate `source: auto` 🤖
- Interactive queries detect Auto Run state to tag stats correctly 🧠
- Smarter cumulative token normalization avoids inflated first-event context % 🛡️
- About modal shows dev commit hash alongside app version 🔍
- Group chat history summaries now strip markdown for cleaner reading 🧹
- Replace any[] with proper types in settings.ts (StoredSession, Group).
- Replace console.log with logger service in process.ts.
- Add consistent debug logging across remote IPC handlers.
- Remove all console.log/console.error statements in favor of logger
- Fix potential race condition in TTS queue by setting isTtsProcessing
flag before checking queue length
- Add comprehensive JSDoc comment explaining TTS_MIN_DELAY_MS (15s) rationale
- Fix type guard for stdin error handling with proper type checks
Add JSDoc comment explaining that web handlers require access to
module-level webServer state with getter/setter functions for proper
lifecycle management, which is why they are registered separately
in main/index.ts rather than through registerAllHandlers().
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add path traversal protection in attachments handlers using path.basename()
- Extract IMAGE_EXTENSIONS constant in filesystem.ts to avoid duplication
- Extract SERVER_STARTUP_TIMEOUT_MS and SERVER_STARTUP_POLL_INTERVAL_MS constants in web.ts
- Add proper AITabData type for aiTabs parameter in web:broadcastTabsChange handler
Add debug logging to help diagnose web broadcast issues. Logs webServer
existence and client count when broadcastUserInput is called.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Addresses PR review feedback on path traversal detection:
1. Fixed false positive issue - now checks for literal ".." path segments BEFORE normalization, allowing valid paths like "/Users/test/my..project" while still blocking traversal attacks like "/Users/../../../etc"
2. Added null byte check - prevents Unix security vulnerability
3. Added Windows reserved names check (CON, PRN, AUX, NUL, COM1-9, LPT1-9)
4. Improved Windows sensitive path detection - now checks across all drive letters (not just C:) and added more system directories
5. Added tests for:
- Valid paths with ".." in directory names
- Null byte rejection
- More specific traversal error assertion
All 102 stores module tests pass. Lint passes.
1. Type Safety: Added StoredSession interface with required fields (id, name, toolType, cwd, projectRoot) and index signature. Changed SessionsData.sessions from any[] to StoredSession[]. Changed GroupsData.groups from any[] to Group[].
2. Test Mock Cleanup: Refactored instances.test.ts to use vi.hoisted() for proper mock scoping, avoiding potential test interference.
3. Path Validation Security: Added isValidSyncPath() to getCustomSyncPath() that rejects relative paths, traversal sequences, paths that are too short, and paths in sensitive system directories.
Added 7 new path validation tests. All 15,311 tests pass.
- Pre-compile regex patterns at module level to avoid repeated compilation in data handlers that fire hundreds of times per second
- Add conditional debugLog() function to skip logging overhead in production (can be enabled via DEBUG_GROUP_CHAT=1 env var)
- Optimize group chat buffer from O(n²) string concatenation to O(n) array-based buffering with single join on read
- Consolidate MaestroSettings interface to single source of truth in persistence.ts to fix type incompatibility errors
- Add troubleshooting section for pre-commit hooks in CONTRIBUTING.md
- Make prepare script resilient for CI/Docker: husky || true
- Update .prettierignore to exclude coverage/ and *.min.js
