Comparing changes

## Summary - Add persistent "system" user bootstrapped at app startup for CLI-to-backend auth - CLI JWT `sub` changed from `"synthorg-cli"` to `"system"` (maps to real DB user) - Removed `aud` claim from CLI JWT (backend's `jwt.decode` doesn't validate audience, causing PyJWT `InvalidAudienceError`) - System user: random Argon2id password (nobody knows plaintext), cannot log in/be modified/appear in user lists - Setup endpoint uses `count_by_role(CEO)` instead of `count()` so system user doesn't block first-run setup - Middleware skips `pwd_sig` for SYSTEM role (validates `iss=synthorg-cli` instead) - Updated Human Roles table in operations design page and security.md ## Why `synthorg backup` and `synthorg wipe` were broken -- the CLI generated JWTs with `sub: "synthorg-cli"` but the backend's auth middleware requires `sub` to map to a real database user. All CLI backup operations failed with "Authentication required". ## Test plan - [x] 119 auth unit tests pass (14 new: system user creation, idempotency, login rejection, password change rejection, setup with system user, CLI JWT auth, role resolution, non-system pwd_sig regression guard) - [x] 10289 total unit tests pass, 93.75% coverage - [x] Go CLI tests pass (JWT sub/iss assertions, aud absence guard) - [x] mypy strict, ruff, golangci-lint all clean - [x] End-to-end simulation: CLI JWT -> backend decode -> system user lookup -> middleware auth -> SYSTEM role write access - [x] Pre-reviewed by 11 agents, 11 findings addressed 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

@cancel

…vements (#712) ## Summary - Fix advanced toggle not reverting visually on Cancel (local ref buffer + @cancel handler) - Normalize dashboard System Status casing ("ok" -> "OK" everywhere) - Make department card edit/delete buttons visible (`outlined` instead of invisible `text`) - Grey out environment-sourced settings with amber message instead of just a badge - Add agent dropdown to department form head field, help text on JSON accordion sections - Use `SettingGroupRenderer` for company General tab (grouped layout with section headers) - Hide `setup_complete` from settings UI (ADVANCED level + HIDDEN_SETTINGS filter) - Rename source badges: "Database" -> "Custom", "YAML" -> "Config File" - Add enum Select placeholder showing definition default when value is empty - Remove unused `default_provider` setting (definition + subscriber + tests) - Make `Department.head` optional in backend model -- departments always show in Org Chart regardless, with "No head assigned" warning when missing ## Test plan - [x] Settings page: toggle advanced ON -> cancel dialog -> verify toggle reverts - [x] Settings page: check no `setup_complete` in API tab (basic mode) - [x] Settings page: source badges show "Custom" / "Config File" / "Default" - [x] Settings page: env-sourced fields greyed out with amber message - [x] Settings page: enum Select shows placeholder when value empty - [x] Company > General tab: grouped layout with section headers - [x] Company > Departments: edit/delete buttons visible on cards - [x] Company > Departments: "No head assigned" warning for headless departments - [x] Company > Departments > Add: head is agent dropdown, help text on JSON sections - [x] Dashboard: all statuses show uppercase "OK" - [x] Providers tab: no `default_provider` setting - [x] Org Chart: departments appear regardless of head being set - [x] Ruff + mypy + pytest (10,273 passed, 93.74% coverage) - [x] ESLint + vue-tsc + vitest (768 passed) ## Review coverage Pre-reviewed by 6 agents (docs-consistency, frontend-reviewer, conventions-enforcer, test-quality, code-reviewer, issue-verifier). 0 findings requiring fixes across all agents. Issue verifier flagged Department.head requirement as the root cause of Org Chart empty state -- addressed in second commit. Closes #709 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

… releases (#715) ## Summary - Every push to main between stable releases creates a PEP 440 dev pre-release (e.g. `v0.4.7.dev3`) with full pipeline: Docker images, CLI binaries, cosign signatures, SLSA provenance - CLI supports `stable` / `dev` update channels via `synthorg config set channel dev` - Dev builds reuse existing Docker + CLI workflows by creating proper `v*` tags ## Changes ### New workflow: `dev-release.yml` - Computes dev version from Release Please pending PR + commit count since last tag - Creates lightweight git tag via GitHub API + GitHub pre-release (marked pre-release) - Auto-cleans old dev pre-releases (keeps 5 most recent) - Concurrency group prevents race conditions between parallel runs ### Docker workflow - Adds rolling `dev` tag for dev builds (only on `refs/tags/v*.dev*`) - Prevents `major.minor` tag on dev builds (avoids overwriting stable `0.4` tag) ### Finalize-release workflow - Guards against publishing dev pre-releases (they're already non-draft) ### CLI (`cli/`) - `Channel` config field (`stable` / `dev`) with validation - `synthorg config set channel dev/stable` command - `synthorg config show` and `synthorg status` display current channel - `CheckForChannel` / `CheckDev` in selfupdate with dev-aware version comparison - Generic `fetchJSON[T]` replaces duplicate HTTP fetch functions - `User-Agent` header on all GitHub API requests - `log_level` validation with allowlist (was accepting arbitrary values) - Table-driven tests for `splitDev`, `compareWithDev`, `isDevUpdateAvailable` ### Docs - CLAUDE.md: dev-release workflow, dev channel flow, config command, dev tags - README.md: config command in quick start ## Pre-PR Review 4 agents ran (go-reviewer, infra-reviewer, security-reviewer, docs-consistency), 18 findings addressed in the second commit. ## Test plan - [ ] Push to main triggers `dev-release.yml`, creates `v0.4.7.devN` tag + pre-release - [ ] Docker workflow triggers on dev tag, builds all 3 images with `dev` + version tags - [ ] CLI workflow triggers, GoReleaser produces binaries with dev version - [ ] `finalize-release` does NOT publish dev pre-releases - [ ] `synthorg config set channel dev` persists in config.json - [ ] `synthorg update` on dev channel finds dev pre-releases - [ ] Stable release always preferred over dev at same base version - [ ] Old dev pre-releases cleaned up (>5 removed) - [ ] `go test ./...` passes (including new version comparison tests) Closes #713 --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

…716) ## Summary - Tags created with the default `GITHUB_TOKEN` do not fire `push` events for other workflows (GitHub Actions anti-recursion safeguard) - The `v0.4.7.dev3` dev pre-release was created successfully but Docker and CLI workflows never triggered - Switch to `RELEASE_PLEASE_TOKEN` (PAT) for the `gh release create --target` step so downstream workflows trigger on dev tags - Cleanup step keeps using `github.token` since it doesn't need to trigger anything ## Context After merging #715, the dev-release workflow ran and created `v0.4.7.dev3` correctly, but the Docker and CLI pipelines never fired. This is the same pattern used by `release.yml` which uses a PAT for Release Please to ensure tag-triggered workflows run. ## Test plan - [ ] Push to main triggers `dev-release.yml`, creates dev tag + pre-release - [ ] Docker workflow triggers on the dev tag (was broken before this fix) - [ ] CLI workflow triggers on the dev tag (was broken before this fix) - [ ] Finalize-release correctly skips dev pre-releases (unchanged) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

…ation (#714) ## Summary - Replace hardcoded `_AUTO_NAMES` role-based name pools with Faker multi-locale name generation across 57 Latin-script locales - Add "Name Generation" step to setup wizard (locale/region selection between Provider and Company steps) - Add `NameLocaleSelector` shared component with All toggle, region groups, and locale chips - Add `GET/PUT /setup/name-locales` and `GET /setup/name-locales/available` API endpoints - Add `name_locales` setting definition (company namespace) with `SettingsNameLocales` component on Settings page - Add explicit diverse names to all 7 built-in template YAMLs - Thread locale preferences through renderer for locale-aware auto-name generation - Add `faker==40.11.0` as production dependency ### Pre-PR review fixes (15 agents, 29 findings) - Fix `Faker.seed()` global state mutation: use local `random.Random` + `seed_instance()` with `lru_cache` for performance - Fix broken `v-if`/`v-else` chain in SettingsPage.vue (GUI + code views rendered simultaneously on non-company tabs) - Add missing `except Exception` handler in `_check_has_name_locales` (prevents TaskGroup crash) - Add WARNING logging for corrupt JSON in `_read_name_locales` - Add mixed sentinel validation (`__all__` cannot combine with explicit locales) - Create `AvailableLocalesResponse` Pydantic model (typed API response) - Use `NotBlankStr` for locale fields in `SetupNameLocalesRequest` - Fix empty catch blocks in Vue components - Update CLAUDE.md and design docs for new feature ## Test plan - [x] `uv run python -m pytest tests/ -n auto --cov=synthorg --cov-fail-under=80` -- 10302 passed, 93.71% coverage - [x] `npm --prefix web run test` -- 768 passed - [x] `uv run mypy src/ tests/` -- no issues - [x] `npm --prefix web run type-check` -- clean - [x] `npm --prefix web run lint` -- clean - [x] Pre-push hooks pass (mypy, pytest, golangci-lint, go vet, go test) - [x] New tests for 3 API endpoints, helper functions, locale edge cases, web store actions 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

#729) ## Summary - Switch dev tag format from PEP 440 (`v0.4.7.dev3`) to semver (`v0.4.7-dev.3`) so GoReleaser can parse them - Create dev releases as **draft** pre-releases instead of published, so they flow through the exact same finalize-release pipeline as stable releases - Remove the dev exclusion guard from finalize-release -- both stable and dev releases now use the same lifecycle ## Why After merging #715 and #716, the dev-release workflow correctly created tags and triggered downstream pipelines, but both failed: 1. **CLI**: GoReleaser rejected `v0.4.7.dev4` as invalid semver (`failed to parse tag as semver`) 2. **Docker**: SBOM attachment failed because dev releases were created as published (immutable), blocking asset uploads ## How it works now Same pipeline, zero special-casing: 1. `dev-release.yml` creates **draft** pre-release + tag (via PAT) 2. Docker workflow triggers on tag -- builds, scans, pushes, attaches SBOMs to draft 3. CLI workflow triggers on tag -- GoReleaser builds binaries, attaches to draft 4. `finalize-release.yml` publishes the draft once both succeed This is identical to the stable release flow. ## Changes - `dev-release.yml`: semver tag format (`-dev.N`), `--draft --prerelease`, updated grep/jq filters - `docker.yml`: `.dev` -> `-dev.` in all contains() checks - `finalize-release.yml`: removed `!contains(.dev)` guard -- handles both stable and dev - `cli/internal/selfupdate/updater.go`: `splitDev` and `selectBestRelease` parse `-dev.` format - `cli/internal/selfupdate/updater_version_test.go`: all test cases updated - `cli/internal/selfupdate/updater_test.go`: integration test cases updated - `CLAUDE.md`: updated tag examples and descriptions - Cleaned up old `v0.4.7.dev3` and `v0.4.7.dev4` releases/tags ## Test plan - [ ] Push to main triggers `dev-release.yml`, creates `v0.4.7-dev.N` tag + **draft** pre-release - [ ] Docker workflow triggers, builds all 3 images, attaches SBOMs to draft - [ ] CLI workflow triggers, GoReleaser builds binaries, attaches to draft - [ ] `finalize-release` publishes the draft after both succeed - [ ] `go test ./...` passes (verified locally) - [ ] `synthorg update` on dev channel finds semver dev releases Closes #713 Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

…ion (#730) ## Summary - **Dev-release tag fix**: `gh release create --draft` does not create a git tag (draft releases are tagless until published). Now creates the tag explicitly via the GitHub API first (using PAT to trigger downstream Docker + CLI workflows), then creates the draft release pointing at it. Adds tag cleanup on release creation failure. - **Dependabot coverage gap**: Added `github-actions` ecosystem entry for `.github/actions/setup-python-uv` composite action, which was missed because Dependabot only scans `.github/workflows/` by default. The composite action was stuck on `[email protected]` while workflows had `v7.6.0`. - **Go CLI command convention**: Switched from `cd cli && go <cmd>` to `go -C cli <cmd>` in CLAUDE.md and pre-pr-review skill. The `cd` approach poisons the shell cwd for all subsequent Bash calls, breaking git/uv/npm commands. `go -C cli` changes directory internally with no side effects. ## Test plan - [ ] Merge and verify dev-release workflow creates both a git tag AND a draft release (check `gh api repos/Aureliolo/synthorg/git/matching-refs/tags/v` for the tag) - [ ] Verify Docker + CLI workflows trigger on the new tag push - [ ] Verify Dependabot picks up `setup-uv` in the composite action (check next daily run or trigger manually) - [ ] Verify `go -C cli test ./...` works in pre-pr-review skill execution Skipped agent review (CI/docs-only changes, no substantive code). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

…etup-python-uv in the minor-and-patch group (#731) Bumps the minor-and-patch group in /.github/actions/setup-python-uv with 1 update: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv). Updates `astral-sh/setup-uv` from 7.4.0 to 7.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v7.6.0 🌈 Fetch uv from Astral's mirror by default</h2> <h2>Changes</h2> <p>We now default to download uv from <code>releases.astral.sh</code>. This means by default we don't hit the GitHub API at all and shouldn't see any rate limits and timeouts any more.</p> <h2>🚀 Enhancements</h2> <ul> <li>Fetch uv from Astral's mirror by default <a href="https://github.com/zsol"><code>@zsol</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/809">#809</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>Switch to ESM for source and test, use CommonJS for dist <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/806">#806</a>)</li> <li>chore: update known checksums for 0.10.10 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/804">#804</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 @<a href="https://github.com/apps/dependabot">dependabot[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/808">#808</a>)</li> <li>Bump deps <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/805">#805</a>)</li> </ul> <h2>v7.5.0 🌈 Use <code>astral-sh/versions</code> as version provider</h2> <h1>No more rate-limits</h1> <p>This release addresses a long-standing source of timeouts and rate-limit failures in setup-uv.</p> <p>Previously, the action resolved version identifiers like 0.5.x by iterating over available uv releases via the GitHub API to find the best match. In contrast, latest and exact versions such as 0.5.0 skipped version resolution entirely and downloaded uv directly.</p> <p>The <code>manifest-file</code> input was an earlier attempt to improve this. It allows providing an url to a file that lists available versions, checksums, and even custom download URLs. The action also shipped with such a manifest. However, because that bundled file could become outdated whenever new uv releases were published, the action still had to fall back to the GitHub API in many cases.</p> <p>This release solves the problem by sourcing version data from Astral’s versions repository via the raw content endpoint:</p> <p><a href="https://raw.githubusercontent.com/astral-sh/versions/refs/heads/main/v1/uv.ndjson">https://raw.githubusercontent.com/astral-sh/versions/refs/heads/main/v1/uv.ndjson</a></p> <p>By using the raw endpoint instead of the GitHub API, version resolution no longer depends on API authentication and is much less likely to run into rate limits or timeouts.</p> <hr /> <blockquote> <p>[!TIP] The next section is only interesting for users of the <code>manifest-file</code> input</p> </blockquote> <p>The <code>manifest-file</code> input lets you override that source with your own URL, for example to test custom uv builds or alternate download locations.</p> <p>The manifest file must be in NDJSON format, where each line is a JSON object representing a version and its artifacts. For example:</p> <pre lang="json"><code>{"version":"0.10.7","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]} {"version":"0.10.6","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]} </code></pre>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/37802adc94f370d6bfd71619e3f0bf239e1f3b78"><code>37802ad</code></a> Fetch uv from Astral's mirror by default (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/809">#809</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/9f00d186ce05fb186322da2c89bac726cc9005f5"><code>9f00d18</code></a> chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/808">#808</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/fd8f376b22c1219b8021404baf54539061a0339a"><code>fd8f376</code></a> Switch to ESM for source and test, use CommonJS for dist (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/806">#806</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f9070de1eac8816a02afc90f4a12cc6fe70d141c"><code>f9070de</code></a> Bump deps (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/805">#805</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/cadb67bdc9933e2f8795f82ab47acc5f41ed4d31"><code>cadb67b</code></a> chore: update known checksums for 0.10.10 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/804">#804</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/e06108dd0aef18192324c70427afc47652e63a82"><code>e06108d</code></a> Use astral-sh/versions as primary version provider (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/802">#802</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/0f6ec07aafe46cff7a322c837e5ba37d95c82b00"><code>0f6ec07</code></a> docs: replace copilot instructions with AGENTS.md (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/794">#794</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/821e5c98158b218f7c8e97d0ea3862c6d6425e8b"><code>821e5c9</code></a> docs: add cross-client dependabot rollup skill (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/793">#793</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/6ee6290f1cbc4156c0bdd66691b2c144ef8df19a...37802adc94f370d6bfd71619e3f0bf239e1f3b78">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/setup-uv&package-manager=github_actions&previous-version=7.4.0&new-version=7.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

## Summary - Fix `type:ci` -> `type:infra` in dependabot.yml (`type:ci` label never existed, `type:infra` covers "CI/CD, tooling, project setup") - Add `dependencies` label to all ecosystems for unified filtering (`gh pr list --label dependencies`) - Split npm `/web` and `/site` into separate entries so they get distinct scope labels - Add scope labels: `scope:web`, `scope:site`, `scope:cli`, `scope:docker` for quick visual identification - Delete orphaned `javascript` label (Dependabot default that was never used since we override labels) Labels already created on the repo: `scope:site`, `scope:cli`, `scope:docker`, `scope:web` (updated description). ## Test plan - [ ] Verify Dependabot picks up the new config and stops complaining about missing `type:ci` - [ ] Confirm new PRs from each ecosystem get the correct label combination ## Review Quick mode (config-only change, no code). No agents run. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

## Summary - Adds a cleanup step to `finalize-release.yml` that deletes **all** dev pre-releases and tags when a stable release is published - Catches releases regardless of state (draft, pre-release, or published) and orphan tags (from failed builds) - Three safety layers: output gate from publish step, `!contains('-dev.')` condition, and runtime `isDraft` verification - Strict regex (`^v[0-9]+\.[0-9]+\.[0-9]+-dev\.[0-9]+$`) ensures stable tags can never be matched - Updates CLAUDE.md to document the behavior ## Test plan - [ ] Merge a Release Please PR and verify all dev releases + tags are deleted - [ ] Verify stable releases and tags are untouched - [ ] Verify the cleanup step is skipped when a dev release is finalized 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

## Summary - **Fix digest-only image discovery**: Docker's `--filter "reference=..."` misses images pulled by digest only (no tag), causing `synthorg uninstall` and `synthorg cleanup` to skip the sandbox image. New `internal/images` package lists all images and filters by repo prefix in Go. - **Eliminate duplicated image logic**: Extract shared `images.ListLocal`, `images.RefForService`, `images.ServiceNames`, and `images.InspectID` -- replacing 3 duplicate constants and 4 duplicate function implementations across `update_cleanup`, `update_health`, `diagnostics`, and `update` commands. - **Standardize all Go tooling on `go -C cli`**: Add golangci-lint as a `tool` directive in `go.mod`, replace all `(cd cli && ...)` and `bash -c 'cd cli && ...'` patterns in pre-commit hooks and documentation. ## Test plan - [x] New `internal/images` package has full test coverage: `TestServiceNames`, `TestRefForService`, `TestLocalImage_ServiceName`, `TestParseImageList` (including digest-only case), `TestParseImageListFieldValues`, `FuzzRefForService`, `FuzzParseImageList` - [x] Existing tests updated to call shared functions (`TestRefForService` in cmd, `TestDiagnosticImageRefPriority` in diagnostics) - [x] `go -C cli build ./...` passes - [x] `go -C cli vet ./...` passes - [x] `go -C cli test ./...` all packages pass - [x] `go -C cli tool golangci-lint run` reports 0 issues - [x] Pre-commit hooks pass (golangci-lint, go-vet, go-test all use new `go -C cli` pattern) - [x] Pre-push hooks pass ## Review coverage Pre-reviewed by 4 agents (docs-consistency, go-reviewer, go-conventions-enforcer, infra-reviewer). 6 findings addressed: 1. Added `images` to CLAUDE.md Package Structure 2. Removed duplicate fuzz target from cmd package 3. Derived display prefix from `images.RepoPrefix` instead of hardcoding 4. Replaced misleading path traversal guard with intentional-fallback documentation 5. Added converse fuzz invariant (no `@` when digest is empty) 6. Silent-fallback behaviour documented as intentional 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

## Summary - Remove all 314 redundant `pytest.mark.timeout(30)` markers across test files -- the global `timeout = 30` in `pyproject.toml` already covers every test - Preserve the 2 intentional `timeout(60)` overrides (Docker sandbox + real LLM integration) - Add `no-redundant-timeout` pre-commit hook (`scripts/check_no_redundant_timeout.py`) to prevent re-introduction - Update CLAUDE.md: document the new hook, clarify timeout is global-only ## Test plan - [x] `grep -r "pytest.mark.timeout(30)" tests/` returns 0 matches - [x] `grep -r "pytest.mark.timeout(60)" tests/` returns exactly 2 matches (kept) - [x] `uv run ruff check src/ tests/` -- all checks passed - [x] `uv run mypy src/ tests/` -- no issues in 1185 files - [x] `uv run python -m pytest tests/ -m unit -n auto` -- 10170 passed - [x] `uv run pre-commit run no-redundant-timeout --all-files` -- passed - [x] Hook correctly rejects new `pytest.mark.timeout(30)` additions (tested manually) ## Review coverage Pre-reviewed by 3 agents (docs-consistency, infra-reviewer, issue-resolution-verifier). 3 findings addressed: 1. CLAUDE.md pre-commit hooks list updated with `no-em-dashes` + `no-redundant-timeout` 2. CLAUDE.md Testing section clarified that timeout is global-only 3. Hook regex hardened with `\s*` to catch whitespace variants Closes #685 --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

…739) ## Summary - **Fix**: GET `/setup/name-locales` was expanding the `__all__` sentinel into 57 individual locale codes via `resolve_locales()`, causing the "All (worldwide)" toggle to always show as OFF on fresh instances. The endpoint now returns the raw sentinel; resolution only happens in the name-generation path. - **UX**: Hide region groups when "All" is toggled ON (no need to show 12 regions when worldwide is selected). - **UX**: Switch region layout from single-column stack to responsive 2-3 column grid with wider container. - **UX**: Default template selection to "Startup" instead of "Start Blank" for a better out-of-box experience. - **Docs**: Add the Names step to the user guide setup wizard description (was missing). ## Test plan - [x] All 10333 tests pass (94% coverage) - [x] mypy strict -- no issues - [x] ruff lint + format -- clean - [x] Vue type-check, lint, and 773 Vitest tests pass - [x] New unit tests for `_read_name_locales(resolve=False)` with sentinel and individual codes - [x] New endpoint test for GET `/name-locales` with explicitly stored `__all__` - [x] Pre-reviewed by 13 agents, 7 findings addressed 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

🤖 I have created a release *beep* *boop* --- ## [0.4.7](v0.4.6...v0.4.7) (2026-03-22) ### Features * add system user for CLI-to-backend authentication ([#710](#710)) ([dc6bd3f](dc6bd3f)) * dev channel builds with incremental pre-releases between stable releases ([#715](#715)) ([0e8a714](0e8a714)) * replace hardcoded name pools with Faker multi-locale name generation ([#714](#714)) ([5edc6ec](5edc6ec)) ### Bug Fixes * dev-release tag creation, dependabot coverage, go -C cli convention ([#730](#730)) ([7634843](7634843)) * improve name generation step UX and fix sentinel expansion bug ([#739](#739)) ([f03fd05](f03fd05)) * settings page UX polish -- toggle bug, source badges, form improvements ([#712](#712)) ([d16a0ac](d16a0ac)) * switch dev tags to semver and use same release pipeline as stable ([#729](#729)) ([4df6b9b](4df6b9b)), closes [#713](#713) * unify CLI image discovery and standardize Go tooling ([#738](#738)) ([712a785](712a785)) * use PAT in dev-release workflow to trigger downstream pipelines ([#716](#716)) ([d767aa3](d767aa3)) ### CI/CD * bump astral-sh/setup-uv from 7.4.0 to 7.6.0 in /.github/actions/setup-python-uv in the minor-and-patch group ([#731](#731)) ([7887257](7887257)) * bump the minor-and-patch group with 3 updates ([#735](#735)) ([7cd253a](7cd253a)) * bump wrangler from 4.75.0 to 4.76.0 in /.github in the minor-and-patch group ([#732](#732)) ([a6cafc7](a6cafc7)) * clean up all dev releases and tags on stable release ([#737](#737)) ([8d90f5c](8d90f5c)) ### Maintenance * bump the minor-and-patch group across 2 directories with 2 updates ([#733](#733)) ([2b60069](2b60069)) * bump the minor-and-patch group with 3 updates ([#734](#734)) ([859bc25](859bc25)) * fix dependabot labels and add scope tags ([#736](#736)) ([677eb15](677eb15)) * remove redundant pytest.mark.timeout(30) markers ([#740](#740)) ([9ec2163](9ec2163)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comparing changes

Open a pull request

Commits on Mar 22, 2026

This comparison is taking too long to generate.

Uh oh!