* fix Next.js build warnings, pin flatted override, regenerate lockfile
* fix ignoreDuringBuilds, add ao-core to serverExternalPackages, clean dist-server in prebuild
* fix ESLint plugin detection, remove ao-core from transpilePackages, suppress plugin-registry webpack warning
* fix(web): restore ao-core to transpilePackages, document overrides, fix dev:optimized cleanup
Move @aoagents/ao-core back to transpilePackages only. dist/ is gitignored so fresh
checkout has no dist/index.js; serverExternalPackages causes a hard crash at runtime.
Client components (SessionDetail, ProjectSidebar, sessions/[id]/page) also import
@aoagents/ao-core/types which serverExternalPackages does not cover.
Keep @composio/core in serverExternalPackages only with comment explaining it is an
optional transitive dep via tracker-linear dynamic import.
Add _overrides_rationale to document axios (SSRF CVE-2023-45857) and flatted
(prototype-pollution) security pins in root package.json.
Fix dev:optimized to clean both .next and dist-server, matching what prebuild does.
* fix: webpackIgnore dynamic imports in plugin-registry fixes#1056
* fix: move Next.js ESLint config to packages/web for build-time detection fixes#1058
* fix: remove scope creep and phantom agent-soma from lockfile
- remove agent-soma importer block from pnpm-lock.yaml
- remove @composio/core from serverExternalPackages
- remove redundant exprContextCritical webpack override
- remove flatted override and _overrides_rationale
- align @next/eslint-plugin-next to ^15.5.15
* fix: replace rm -rf with rimraf for cross-platform compatibility
* fix: use rimraf in clean script and sort devDependencies
* fix: add postcss.config.mjs to web ESLint ignores
* fix: restore no-console exemption for web package in root ESLint config
Renames all npm package scopes from @composio/* to @aoagents/* and
updates GitHub repo references from ComposioHQ/agent-orchestrator
to aoagents/ao throughout the codebase.
- All package.json names and dependencies
- README badges, links, and install instructions
- Documentation references
- Changeset config
- Source code imports and test files
* fix: reduce dashboard JS bundle from 1.7MB to 170KB (gzipped) (#792)
Switch `ao start` default from `next dev` (7.6MB uncompressed) to optimized
production builds (128KB per route). Add `--dev` flag for HMR when editing
dashboard UI. Add bundle analyzer, server-only guards, and lazy-load
DirectTerminal via next/dynamic.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: skip dashboard rebuild when assets exist, fix CI timeout
Skip the production build step when .next/BUILD_ID and dist-server/
already exist (e.g. after pnpm build in CI). Add c8 ignore for
untestable process-spawning startup code to fix diff coverage.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: adopt PR #903 patterns — centralize rebuild logic and add preflight web artifact checks
Extract rebuildDashboardProductionArtifacts into dashboard-rebuild.ts, add
isInstalledUnderNodeModules/assertDashboardRebuildSupported guards, remove
findProcessWebDir, and verify .next/BUILD_ID + dist-server/start-all.js in
preflight. Dashboard command now always uses production server.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: skip production preflight in --dev mode, add coverage for rebuild helpers
- Skip preflight.checkBuilt() when --dev is passed (dev mode uses HMR,
doesn't need .next/BUILD_ID or dist-server/start-all.js)
- Add c8 ignore to dashboard.ts process-spawning code (matches start.ts pattern)
- Add tests for rebuildDashboardProductionArtifacts (success, failure, npm guard)
- Add preflight tests for npm-install web artifact hint paths
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: align preflight skip with actual dev-server condition
Only skip production artifact preflight when both --dev is passed AND
we're in the monorepo (where dev mode actually works). For npm global
installs, --dev is silently ignored and production server runs, so
preflight must still validate .next/BUILD_ID and dist-server/start-all.js.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: match @next/bundle-analyzer version to next@^15.1.0
The @next/* packages follow the Next.js release train. Pin the bundle
analyzer to ^15.1.0 to match the project's next dependency.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: correct recovery command for npm installs and remove redundant guard
- Change stale-build recovery suggestion from "ao update" (which only
works in source checkouts) to "npm install -g @composio/ao@latest"
for npm global installs
- Remove redundant assertDashboardRebuildSupported call in dashboard.ts
since rebuildDashboardProductionArtifacts already calls it internally
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
tracker-linear dynamically imports @composio/core (Composio SDK), an
optional dependency that isn't installed. Webpack tried to bundle it
at build time, causing __webpack_require__.C is not a function and
breaking all server-side rendering with a 500 Internal Server Error.
Adding it to serverExternalPackages tells Next.js to leave the import
as a runtime require instead of bundling it. The plugin already handles
the "not installed" case gracefully at runtime.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add web app manifest (manifest.ts) with dynamic project name, standalone display
- Add service worker (sw.js) with network-first strategy and offline fallback page
- Add PWA icons: apple-touch-icon (180x180), 192x192, 512x512 via shared renderer
- Add viewport meta with viewport-fit=cover for safe-area-inset support
- Add Apple Web App meta tags for iOS home screen installation
- Add theme-color meta for browser chrome coloring
- Extract shared icon-renderer.tsx to deduplicate icon generation logic
- Add ServiceWorkerRegistrar client component for SW registration
- Configure next.config.js with no-cache headers for service worker
- Add dvh fallbacks for 100vh usage (body, kanban-board, Terminal, DirectTerminal)
- Add safe-area-inset padding for mobile sidebar and dashboard main
- Add iOS auto-zoom prevention (16px font on inputs)
- Add -webkit-tap-highlight-color: transparent and text-size-adjust
- Add PWA standalone mode body padding for safe areas
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Publish @composio/ao-web dashboard as npm package (removed private flag,
added files field, production entry point, node-pty made optional)
- CLI auto-detects dev vs production mode for dashboard startup
- Use local next binary instead of npx in production start-all.ts
- findWebDir() throws with install-specific guidance instead of returning
broken path
- Fix CI-silent failure: setup.sh and ao-update.sh exit 1 on non-interactive
npm link failure
- Deduplicate detectDefaultBranch into shared cli/lib/git-utils.ts
- Add EACCES permission guidance to README.md and SETUP.md
- Move resolveProjectIdForSessionId to @composio/ao-core
- Update design doc with problems #8-13, changes #9-12, known limitations
section, and expanded test plan
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add npm publishing support with @composio scope
Set up Changesets for version management, add publish metadata to all 20
packages under the @composio scope, create an unscoped wrapper package
(@composio/agent-orchestrator) for global install, and add a GitHub
Actions release workflow.
- Rename all packages from @agent-orchestrator/* to @composio/ao-*
- Add @composio/agent-orchestrator wrapper (bin shim → @composio/ao-cli)
- Add license, repository, homepage, bugs, files, engines to all packages
- Add .npmrc (access=public), MIT LICENSE file
- Add .changeset/ config with linked versioning for all packages
- Add .github/workflows/release.yml (changesets publish CI)
- Add changeset, version-packages, release scripts to root
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* fix: exclude private web package from release build
The release script now filters out @composio/ao-web, matching the
workflow's existing exclusion and preventing a Next.js build failure
from blocking npm publishing.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
* feat: implement web dashboard with attention-zone UI, API routes, and SSE
Implements the Next.js 15 web dashboard for INT-1332 with:
- Attention-prioritized session cards (urgent/action/warning/ok/done zones)
- 6 API routes: sessions, spawn, send, kill, merge, SSE events
- 5 components: SessionCard, AttentionZone, PRStatus, CIBadge, Terminal
- Session detail page with PR merge readiness, CI checks, unresolved comments
- Tailwind CSS 4 dark theme matching the reference bash dashboard
- Mock data layer covering all attention states for development
- SSE endpoint for real-time lifecycle event streaming
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* test: add vitest test suite for web dashboard (77 tests)
Add comprehensive tests covering API routes, component rendering, and
attention-level classification. Fix merge button visibility when no alerts present.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address all PR review feedback
- Fix SSE memory leak: add cancel() handler to clear intervals on disconnect
- Add X-Accel-Buffering header for reverse proxy compatibility
- Add input validation on all API routes (validateString, validateIdentifier)
- Import core types (SessionStatus, ActivityState, CIStatus, etc.) from
@agent-orchestrator/core instead of redeclaring them
- Fix hydration mismatch: render timestamp client-side only via useEffect
- Add error handling on fetch calls in Dashboard (check response.ok)
- Add cn() utility for conditional class composition
- Fix setTimeout leak: use useRef + useEffect cleanup in SessionCard
- Fix getAttentionLevel edge case: status-based checks outside PR block
- Add NaN check on parseInt in merge route
- Extract duplicated sizeLabel logic into shared getSizeLabel()
- Add TODO guard comment on mock-data.ts for production removal
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address Codex review feedback (iteration 1)
- Use strict /^\d+$/ validation on PR merge route (reject "432foo")
- Treat exited agents with non-terminal status as urgent (crashed agents)
- Add explicit getAttentionLevel mappings for review_pending, approved, cleanup
- Guard SSE update loop against empty sessions array
- Use encodeURIComponent on session details link
- Tighten mergeScore types to Pick<DashboardPR, ...>
- Add stripControlChars() and apply to send route for shell safety
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: apply ESLint and Prettier formatting after rebase on main
- Add next-env.d.ts to ESLint ignores (triple-slash reference)
- Merge duplicate imports using inline type syntax (no-duplicate-imports)
- Replace non-null assertions with proper null checks
- Apply Prettier formatting across all packages
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address Cursor Bugbot review findings
- Add reviewDecision "none" to warning zone in getAttentionLevel
- Change ACTION zone color from green to orange for proper priority signaling
- Fix SessionDetail date hydration mismatch with ClientDateCard pattern
- Add export const dynamic = "force-dynamic" to SSE route
- Add --color-accent-orange CSS variable
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address Codex review iteration 2 findings
- Gate merge route on PR state (409 if not open) and draft status (422)
- Handle pr.state === "closed" in getAttentionLevel → done zone
- Reject messages that become empty after control char stripping
- Align SSEEvent types with actual emitted events (snapshot + activity)
- Add 6 new tests for edge cases (85 total)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve typecheck error in test helper (NextRequest init type)
Cast RequestInit to NextRequest's ConstructorParameters to fix
type incompatibility between global RequestInit.signal (null allowed)
and Next.js RequestInit.signal (null not allowed).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve remaining review threads (zone colors, draft PRs, ternary)
- WORKING zone uses green (not blue) per design spec
- ACTION zone uses orange, consistent across all components
- Draft PRs with reviewDecision "none" fall to ok (not warning)
- Remove redundant ternary in getAttentionLevel
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: add Playwright screenshot tooling for visual verification
Agents and developers can now capture headless Chromium screenshots of
the running dashboard. Includes dev server auto-start, default page
specs, and CLI arg parsing. Screenshots committed to branch for PR
visibility.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add session detail screenshot after compact metadata redesign
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add screenshots for session detail redesign + zone reclassification
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address bugbot findings — unused type, kill route validation, draft PR awareness
- Remove unused SSEEvent type alias from types.ts
- Add validateIdentifier() to kill route for session ID validation
- Skip "needs review" alert for draft PRs in SessionCard getAlerts()
- Show "draft" instead of "needs review" in PRTableRow for draft PRs
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: session detail redesign + attention zone reclassification
Session Detail:
- Nav bar replacing standalone back link
- Meta chips (project/branch/issue) with GitHub links
- Humanized status labels and relative timestamps
- Unified PR card with stats row, issues list, inline CI checks
- Clickable file paths in unresolved comments
Attention Zones (reordered by human action urgency):
- merge: PRs ready to merge (highest ROI per second)
- respond: agents waiting for input (quick unblock)
- review: CI failures, changes requested, conflicts
- pending: waiting on reviewer or CI
- working: agents doing their thing
- done: merged or terminated
Also fixes:
- Add validateIdentifier() to send route for session ID
- Update all tests for new zone names
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: resolve 3 remaining review threads
- Remove duplicate eslint ignore entry for next-env.d.ts
- Export checkStatusIcon and ciCheckSortOrder from CIBadge, import in
SessionDetail instead of duplicating
- Add restore API route (was untracked)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restore route validation, merged session guards
- Add validateIdentifier() to restore route (matches kill/send routes)
- Block restoring merged sessions with 409 response
- Hide kill button for merged sessions in top-row and expanded panel
- Expanded panel now shows restore OR terminate (not ternary fallback)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: exclude e2e from tsconfig include (fixes next build)
The e2e directory imports playwright which isn't resolvable during
next build. Since e2e files are standalone tooling (not app code),
exclude them from the main tsconfig include.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor: unify CI check rendering via CICheckList layout prop
Add layout prop ("vertical"|"inline"|"expanded") to CICheckList,
remove duplicated InlineCIChecks from SessionDetail in favor of
reusing CICheckList with the appropriate layout mode.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: add isDraft guard to unresolvedThreads pending check
Draft PRs with unresolved threads should fall through to "working",
not "pending". Adds the missing !pr.isDraft guard to match the
reviewDecision check on the next line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address 9 bugbot findings across e2e, SSE, and mock-data
- server.ts: kill child process on waitForServer failure, drain stdout
to prevent backpressure
- screenshot.ts: validate Number() args for NaN with clear error messages
- events/route.ts: initialize interval variables as undefined
- mock-data.ts: exclude draft PRs from needsReview stat count
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: prevent simultaneous restore and kill buttons in SessionCard
Add !isRestorable guard to kill button condition so the two buttons
are mutually exclusive. Restorable sessions show restore; non-restorable
exited sessions show kill.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: remove unreachable kill button from SessionCard top row
The kill button in the top row was dead code — isRestorable already
covers all activity === "exited" cases, so the !isRestorable && exited
condition could never be true.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: update tests to match SessionCard after kill button removal
Tests referenced "kill session" text that no longer exists. Exited
sessions show "restore session", not "kill session". Updated 4 tests
to use onRestore/restore session instead of onKill/kill session.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Ashish Huddar
harshitsinghbhandari
Pritom Mazumdar
Prateek
suraj_markup
fireddd
Ashish Huddar
suraj-markup