Commands now reload project metadata from output files after backend
operations, ensuring session.project_data reflects actual changes.
Previously, snapshot() captured state before mscore operations, but
project_data was never updated afterward—undo restored unchanged
metadata. Now all mutation commands (transpose, add/remove/reorder
instruments) update session state from the output file.
Fixes the issue identified in PR review where undo/redo was
scaffolding-only for backend-driven harnesses.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix add_instrument off-by-one: count parts before SubElement append
- Replace bare except with logger.debug in instruments, media, parts, project
- Make project save delegate to real mscore export instead of no-op
- Pass help= to Click export subcommands for proper --help text
- Preserve --json flag across REPL command dispatches
- Guard `import fcntl` for Windows compatibility (try/except with fallback)
- Use `shlex.split()` in REPL for proper quoted argument handling
- Error on incomplete `reorder_instruments` to prevent silent data loss
- Use `functools.wraps` in `handle_error` decorator
First music notation tool in the CLI-Anything ecosystem. Wraps MuseScore 4's
mscore backend following the HARNESS.md 7-phase methodology.
Supports: transpose (by key/interval/diatonic), export (PDF/PNG/SVG/MP3/FLAC/
WAV/MIDI/MusicXML/Braille), part extraction, instrument management, score
analysis (probe/diff/stats), and interactive REPL with undo/redo.
56 tests (39 unit + 17 E2E) — all passing on macOS with MuseScore 4.6.5.
- Add auto-save via result_callback so --project flag triggers disk
write after every mutating command, fixing broken consecutive
operations in non-REPL mode.
- Switch REPL arg parsing from str.split() to shlex.split() so that
quoted strings with spaces (e.g. --text "Summer Sale") are handled
correctly.
Fixes#111
- save_history() now writes to session JSON so history survives restarts
- Use fcntl.flock exclusive locking on session writes (ported from blender harness)
- Reset modified flag after _save()
- Remove sys.path.insert; rely on proper package installation
- clear() also resets history
Addresses review feedback from sehawq on #101.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Implement novita/agent-harness with OpenAI-compatible API client
- Add chat completion, streaming, model listing support
- Include CLI with chat, session, and config commands
- Add tests with mocked API calls
- Update registry.json with Novita entry
- Update .gitignore to include novita/
- Resolve merge conflict in README.md test badge (1,684 → 1,720)
- Update all app/demo counts from 14 → 16 to reflect all CLIs in registry
- Update test counts: 1,247 unit + 473 e2e = 1,720 total
- Add AdGuardHome entry to registry.json with contributor info (pyxl-dev)
- Add contributor/contributor_url fields to all registry entries
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- log_config: trigger POST when --interval is passed without --enabled,
read current config for missing parameters
- set_enabled: read current filter interval from server instead of
hardcoding 24h
- Update test mock to cover the new get_status call in set_enabled
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add section explaining the behavior change for callers using non-listed
codecs, with instructions on how to extend the allowlists.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Deduplicate logical document paths by freshest metadata so open-path resolves real Mubu history duplicates consistently. Overlay backup-driven show/link output with metadata titles and doc paths, and default new public state to ~/.config/mubu-cli while preserving legacy fallback.
extra_args could pass vcodec=..., acodec=..., or -consumer to override
the validated codec parameters. Add _validate_extra_args() that rejects
any argument starting with these prefixes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When an AI agent constructs CLI commands, it may pass arbitrary strings as
codec parameters — either through prompt injection, hallucination, or
processing untrusted input. Since codec values are passed directly to
melt/ffmpeg subprocesses, unvalidated input is an injection risk.
Fix: add ALLOWED_VCODECS / ALLOWED_ACODECS allowlists to both kdenlive
and shotcut melt_backend.py. All codec parameters are validated before
reaching subprocess.run(). Unknown codecs raise ValueError with a list
of valid options.
Also add SECURITY.md documenting the project's threat model (AI agents
as CLI callers), attack surfaces, reporting process, and security
guidelines for harness developers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update the package metadata, generated skill output, test expectations, and registry entry so the contribution PR reflects the generalized daily-folder behavior in the published harness version.
Require an explicit daily folder reference or MUBU_DAILY_FOLDER for daily helpers, scrub personal examples from docs and generated skill content, and harden live E2E checks for environment-specific SSL failures.
Reverts all unintended em-dash → hyphen replacements introduced in
previous commits. README is now restored from upstream (e0dd643) with
only the three AdGuardHome-related additions: badge count update,
categories table row, and project structure entry.
Addresses review feedback from yuh-yang on PR #65.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Extract duplicate Path(config_path) conversion to a single variable
- save_config() now accepts and persists the https flag, ensuring
load/save roundtrip symmetry for all config fields
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
