refactor(tui): move TUI core in-tree under pkg/, remove GitNexus - #55
Merged
Conversation
…ss, d4) Renames the `s3` command to `object-storage` to avoid the naming conflict with AWS S3. Adds `oss` and `d4` as aliases. BREAKING CHANGE: `verda s3 ...` no longer works. Use `verda object-storage ...` (or the `oss` / `d4` aliases) instead. Scope: - Folder/package renamed s3/ -> objectstorage/ (Go package `objectstorage`, constructor `NewCmdObjectStorage`); subcommand logic and tests unchanged. - Command `Use: "object-storage"`, `Aliases: [oss, d4]`; root help and the credential-skip check updated accordingly. - All `verda s3 ...` / `--agent s3 ...` invocations in help, examples, README, per-command CLAUDE.md, and embedded skills rewritten to `verda object-storage ...`; aliases documented in the skills. - Stale `s3` cross-references in the sibling `registry` package docs and comments fixed (incl. the user-facing registry README copy-wizard note that pointed at the now-removed `s3 cp`). Intentionally preserved (non-breaking): the `s3://` URI scheme and the `verda_s3_` credential keys, so existing credentials and paths keep working. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Addresses two standard-library vulnerabilities flagged by govulncheck, both fixed in go1.25.11: - GO-2026-5039: unescaped inputs in net/textproto errors (reached via util.debugTransport.RoundTrip -> io.ReadAll -> textproto.Reader.ReadMIMEHeader) - GO-2026-5037: inefficient candidate hostname parsing in crypto/x509 (reached via registry.httpLister.Ping and util.ClassifyError) CI installs the toolchain from go-version-file: go.mod, so bumping the `go` directive is sufficient. Verified clean with `GOTOOLCHAIN=go1.25.11 govulncheck ./...` -> No vulnerabilities found. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
User feedback: the code-graph tooling isn't pulling its weight. Drops the GitNexus blocks from AGENTS.md/CLAUDE.md and the .gitignore entry. The local .gitnexus/ index and .claude/skills/gitnexus/ were machine-local (untracked) and have been deleted.
pkg/tui (+ bubbletea/wizard/testing), pkg/log and pkg/version are copied from verdagostack v1.4.2 with no logic changes (import paths and a few doc comments rewritten; tui/examples and log/adapter (gin/gorm/kratos) not copied). TUI iteration no longer needs a cross-repo replace + release cycle: edit and test in this repo. - rewrite all imports verdagostack/pkg/... -> verda-cli/pkg/... - drop the verdagostack requirement from go.mod (zap/bubbles now direct) - .goreleaser.yml: ldflags -X version path updated, else release binaries would silently lose version stamping - --version output drops the Verdagostack line (dep no longer exists) - .golangci.yaml: pkg/ gets path-scoped exclusions for style heuristics that fight the Bubble Tea idiom (hugeParam on value-receiver models, predeclared min/max in public option types); correctness linters still apply to pkg/ - docs (CLAUDE.md, AGENTS.md, per-command docs, new-command skill) reference pkg/ instead of verdagostack
The boilerplate '*testing' .gitignore pattern matched the pkg/tui/testing
directory name, so 'git add -A' silently skipped the tuitest prompter
package when vendoring. Local builds saw the files on disk, but they were
never committed — a clean checkout of the branch cannot compile the
objectstorage/registry tests that import tuitest.
- add pkg/tui/testing/{prompter.go,prompter_test.go} (imports rewritten
like the rest of pkg/)
- .gitignore: negate '**/testing/' — Go testing/ package dirs are
library code, not the loose test junk the generated block targets
2 tasks
CI builds golangci-lint v2.5.0 while local dev uses newer; prealloc fires under v2.5.0 only (pkg/tui/wizard/composite.go). pkg/ is library code and already excluded from style-heuristic linters — add prealloc to stop version-skew noise on the vendored tree.
govulncheck on CI flagged real call chains into crypto/tls (GO-2026-5856, fixed in 1.25.12); the OSV/Trivy hits were manifest-level: - go 1.25.11 -> 1.25.12: GO-2026-5856, GO-2026-4970 (stdlib) - x/text 0.36.0 -> 0.39.0: GO-2026-5970 (CVE-2026-56852) - klauspost/compress 1.18.5 -> 1.18.7: GO-2026-5841 - otel{,/trace,/metric} 1.43.0 -> 1.44.0: GO-2026-5158 - x/sync 0.20.0 -> 0.21.0 (required by x/text bump) Verified locally: govulncheck under go1.25.12 reports no vulns; all five new versions have zero OSV hits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two commits:
refactor(tui): move TUI core in-tree under pkg/—pkg/tui(+bubbletea/wizard/testing),pkg/log,pkg/versioncopied from verdagostack v1.4.2 with zero logic changes (import paths + a few doc comments rewritten;tui/examplesandlog/adapter(gin/gorm/kratos) deliberately not copied). TUI iteration no longer needs a cross-reporeplace+ release cycle — edit and test directly in this repo.chore: remove GitNexus code-graph integration— per user feedback that the code-graph tooling isn't pulling its weight: drops the GitNexus blocks from AGENTS.md/CLAUDE.md and the.gitignoreentry. (The.gitnexus/index and.claude/skills/gitnexus/were machine-local/untracked.)Details worth reviewing
.goreleaser.yml: ldflags-Xversion path updated to the new in-treepkg/version— without this, release binaries would silently lose version stamping.verdagostackrequirement dropped entirely (zap/bubbles promoted to direct)..golangci.yaml:pkg/gets path-scoped exclusions for style heuristics that fight the Bubble Tea idiom (e.g.hugeParamon value-receiver models,predeclaredmin/max in public option types). Correctness linters still apply. This mirrors how the code was linted upstream.--versionoutput drops theVerdagostack:line (the dep no longer exists).pkg/; pre-commit gofmt re-sorted imports in 26 files after the path rewrite.Note:
make testrunsgo test ./...only — lint runs viamake lint/ pre-commit. CLAUDE.md's claim thatmake testincludes linting is stale; left for a follow-up.Test plan
make buildmake lint— 0 issues (incl. newpkg/)make test— 27 packages pass--version,--help,vm create --help,registry --help