Skip to content

chore: sync with harlan-zw/harlan-agent-kit through 8f6ac424 - #12

Merged
RedStar071 merged 2 commits into
mainfrom
chore/sync-harlan-upstream-20261017
Oct 18, 2026
Merged

RedStar071 merged 2 commits into
mainfrom
chore/sync-harlan-upstream-20261017

Conversation

@RedStar071

Copy link
Copy Markdown
Member

❓ Type of change

  • 📖 Documentation
  • 🐞 Bug fix
  • 👌 Enhancement
  • ✨ New feature
  • 🧹 Chore
  • ⚠️ Breaking change

📚 Description

The fork was 14 upstream commits behind (3685edbc..8f6ac424). They are replayed here with the Wolfstar names, one file at a time, because a plain merge of the rebranded tree conflicts on almost every line.

What comes in: phone navigation keys and a loading state for Sessions, terminal history that survives a finished session, Codex Sessions with explicit full access, Hogwild emergency isolation with a phone power-off control (new security/ folder), terminal/ branches as writable PR heads, and a dependency refresh.

Kept on purpose: Oxlint and Oxfmt formatting (upstream uses ESLint stylistic), the harlanzw.com hosts and the @harlan-zw/* packages. pnpm-lock.yaml is regenerated from this fork's resolution, not copied from upstream, so review pnpm-workspace.yaml rather than the lockfile diff.

Open question: the emergency broker ships as systemd units under packages/wolfstar-github-agent/security/. I did not install or run them anywhere, so the Hogwild side is untested here.

🤖 AI disclosure: Wolfstar Agent Kit modified this description. My AI open-source policy.

Bring in the 14 upstream commits since 3685edb, rebranded for Wolfstar:
- Sessions: phone terminal navigation keys, Sessions screen loading state,
  terminal history reading copies, archive failure isolation
- Codex Sessions can run with explicit full access
- Hogwild emergency isolation and phone power-off control, with the
  emergency broker, passkey export and security docs
- Triage and Review evidence stay current; SVG evidence avoids host font scans
- terminal/ branches are writable pull request heads
- dependency refresh (catalog, lockfile)

Kept on purpose: Oxlint and Oxfmt formatting, the harlanzw.com hosts and
@harlan-zw/* packages that still exist upstream.
@coldtea-pr-lens

Copy link
Copy Markdown

Note

The title starts with chore:, so PR Lens left this pull request undrawn. Comment @pr-lens draw to draw it

github.comment.notice: false in .github/pr-lens.yml turns this note off

@socket-security

socket-security Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Medium priority
License policy violation: npm @expo-google-fonts/noto-emoji under OFL-1.1

License: OFL-1.1 - the applicable license policy does not allow this license (4) (npm metadata)

License: OFL-1.1 - the applicable license policy does not allow this license (4) (package/package.json)

License: OFL-1.1 - The applicable license policy does not permit this license (5) (package/LICENSE_FONT)

From: packages/wolfstar-github-agent/package.json → npm/@expo-google-fonts/noto-emoji@0.4.8

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@expo-google-fonts/noto-emoji@0.4.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Failed ❌

View logs ↗
84d28d5 2026-10-18T09:57:02.283Z View logs ↗
  • Build: Failed ❌

View logs ↗
a580654 2026-10-18T08:04:54.064Z View logs ↗

Oxfmt split the two-statement inline handler across lines without a
semicolon, which the Vue template compiler rejects in the dashboard build.
@RedStar071
RedStar071 merged commit 3bf98e7 into main Oct 18, 2026
7 of 8 checks passed
@RedStar071
RedStar071 deleted the chore/sync-harlan-upstream-20261017 branch October 18, 2026 10:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant