All pull requests

Pull requests

• fix(studio): P0b refuse .git landing paths + harden server git invocations

  #522·brianonbased-dev opened Oct 6, 2026Owner·

  ·
  1

• docs: every change goes through a PR (F.089, NORTH_STAR rule 8)

  #520·brianonbased-dev opened Oct 6, 2026Owner·

  ·
  1

• test: local-custody dispatch + scan-root credits assertions (#407 follow-up)

  #519·brianonbased-dev opened Oct 6, 2026Owner·

  ·
  1

• feat(arcore-runner): restore pull-sweep (phone room sweep -> HoloMap replay)

  #518·brianonbased-dev opened Oct 6, 2026Owner·

  ·

• fix(cli/threejs): emit rotation in radians; HoloScript rotation is degrees

  #517·brianonbased-dev opened Oct 6, 2026Owner·

  ·
  1

• feat(core,cli): back-translation proof, slice 1

  #512·brianonbased-dev opened Oct 5, 2026Owner·

  ·
  1

• fix(core): .holo reports what it drops; .hs param lists cannot hang

  #509·brianonbased-dev opened Oct 5, 2026Owner·

  ·

• feat(cli): a pipeline reads an environment variable only if the operator allows it

  #497·brianonbased-dev opened Oct 5, 2026Owner·

  ·
  4

• test(mcp-server): the premium census counts code, not comments, so a comment cannot hide a new ungated read

  #470·brianonbased-dev opened Sep 29, 2026Owner·

  ·
  3

• fix(mcp-server): the stateless tool routes run the tool-call gate, observing first

  #463·brianonbased-dev opened Sep 29, 2026Owner·

  ·
  3

• fix(mcp-server): marketplace search names a loopback marketplace only on stdio, so the hosted server never sends its key to a caller's local port

  #459·brianonbased-dev opened Sep 29, 2026Owner·

  ·
  3

• The OAuth client store takes new clients again, and says so when it cannot

  #458·brianonbased-dev opened Sep 29, 2026Owner·

  ·
  3

• fix(mcp-server): a mesh tool served over HTTP reaches only the public internet unless an operator calls it

  #457·brianonbased-dev opened Sep 29, 2026Owner·

  ·
  5

• fix(mcp-server): a declared manifest tier is believed only when this process is the stdio server

  #449·brianonbased-dev opened Sep 29, 2026Owner·

  ·
  3

• fix(deps): patch undici DoS, fast-uri authority-injection/host-confusion, morgan log-injection

  #442·brianonbased-dev opened Sep 28, 2026Owner·

  ·
  4

• fix(hooks): pre-commit and commit-msg are stored executable, so Linux clones run them; pre-commit refuses a hook stored otherwise

  #412·brianonbased-dev opened Sep 28, 2026Owner·

  ·
  1

• fix(mcp-server): every knowledge write says what the orchestrator did, and a refused daemon batch is retried

  #409·brianonbased-dev opened Sep 28, 2026Owner·

  ·
  3

• fix(mcp-server): the heartbeat, messages, broadcasts and every GET to the orchestrator give up when it goes silent

  #408·brianonbased-dev opened Sep 28, 2026Owner·

  ·
  3

• fix(mcp-server): holomesh_query never checked whether the caller belongs to the team workspace it names

  #400·brianonbased-dev opened Sep 28, 2026Owner·4 of 5 tasks·

  ·
  3

• fix(marketplace-api): require a verified JWT for skill publish and delete

  #369·brianonbased-dev opened Sep 27, 2026Owner·4 of 11 tasks·

  ·
  2

• fix(marketplace-api): build and ship @holoscript/meaning in the runtime image

  #367·brianonbased-dev opened Sep 27, 2026Owner·7 of 15 tasks·

  ·
  3

• fix: skip docs-only deploys for mcp-server, studio, and absorb-service

  #364·brianonbased-dev opened Sep 27, 2026Owner·7 of 12 tasks·

  ·
  2