Skip to content

feat: Phase 5 — exporter, 5 tools, SSRF transport #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
prosdev merged 5 commits into from
Mar 15, 2026
Merged

feat: Phase 5 — exporter, 5 tools, SSRF transport #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0f800a1
docs: add Phase 5 plan for exporter, tools, and SSRF transport
prosdev Mar 14, 2026
830b115
feat: add exporter, 5 tools, and SSRF-hardened transport
prosdev Mar 14, 2026
7e04033
fix: address code review findings for Phase 5
prosdev Mar 14, 2026
e0265a2
docs: clarify tool response envelope in BaseTool docstring
prosdev Mar 15, 2026
479406b
fix: validate edge condition_branch and add O_NOFOLLOW test
prosdev Mar 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 26 additions & 3 deletions .claude/agents/research-planner.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,13 @@ You are a senior software engineer helping me plan features.
- Plans go in `.claude/gw-plans/` following the existing structure.
- Each plan should be self-contained: someone reading only the plan file should understand
what to build and why.
- **Include ASCII diagrams** to visualize architecture, data flow, or component relationships.
Diagrams make plans faster to review and easier to reason about. Use them for:
- Module/file dependency graphs
- Request/response flows (e.g., how a tool call flows from state → input_map → tool → output_key)
- State transformations (what goes in, what comes out)
- Security boundaries (what's sandboxed, what talks to external systems)
- Anything where a picture is worth 50 lines of prose
- Include a "Not in Scope" section to prevent scope creep.
- Include a "Decisions & Risks" section documenting assumptions and their mitigations.
- Include a "Commit Plan" section: ordered list of commits, each with a conventional commit
Expand Down Expand Up @@ -70,10 +77,26 @@ You are a senior software engineer helping me plan features.
- Use your judgement on the threshold. If a plan exceeds ~400 lines or has 3+ distinct
commits touching different modules, split it.

## Revision Workflow (for the orchestrating agent)
## After Writing a Plan

Once you have written or updated a plan file, **signal that it's ready for review**.
Include the plan file path in your response so the main conversation knows what to review.

The agentic loop (driven by the main conversation):
1. **research-planner** writes/updates the plan → signals "ready for review"
2. Main conversation launches **plan-reviewer** on the plan file
3. If plan-reviewer returns REVISE → main conversation resumes **research-planner** to address findings
4. Repeat until plan-reviewer returns APPROVE

You cannot spawn sub-agents yourself. End your response with a clear handoff:
```
READY FOR REVIEW: .claude/gw-plans/path/to/plan.md
```

## Revision Workflow
When plan-reviewer findings need to be applied to a large feature (overview + parts):
1. **Fix the overview first** (sequentially) — it sets the architecture decisions that parts reference.
2. **Fix the part files in parallel** — they are independent of each other and can reference
the updated overview. This gives consistency and speed.
The research-planner cannot spawn sub-agents itself. The orchestrating agent (main conversation)
should launch parallel research-planner invocations for the part files after the overview is done.
The research-planner cannot spawn sub-agents itself. The main conversation should launch
parallel research-planner invocations for the part files after the overview is done.
2 changes: 1 addition & 1 deletion .claude/gw-plans/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ Implementation deviations are logged at the bottom of each plan file.

| Track | Description | Status |
|-------|-------------|--------|
| [Execution](execution/) | FastAPI + LangGraph backend | Phases 1-3 merged, 4 in progress |
| [Execution](execution/) | FastAPI + LangGraph backend | Phases 1-4 merged, 5 in progress |
| [Canvas](canvas/) | React + React Flow frontend | Not started |
| Deployment | Cloud Run + Vercel + CI/CD | Not started (after both tracks) |

Expand Down
4 changes: 2 additions & 2 deletions .claude/gw-plans/execution/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,5 +10,5 @@ FastAPI + LangGraph backend phases.
| 1.5 | [Scoped API Key Auth](phase-1.5-execution-auth.md) | Merged | [#2](https://github.com/prosdevlab/graphweave/pull/2) |
| 2 | [GraphSchema -> LangGraph Builder](phase-2-graph-schema-langgraph-builder.md) | Merged | [#3](https://github.com/prosdevlab/graphweave/pull/3) |
| 3 | [Executor + SSE Streaming](phase-3/overview.md) | Merged | [#6](https://github.com/prosdevlab/graphweave/pull/6) |
| 4 | [API Routes (validate, export, run history, cancel, delete)](phase-4-api-routes.md) | In progress | — |
| 5 | Exporter + remaining tools + SSRF transport | Not started | — |
| 4 | [API Routes (validate, export, run history, cancel, delete)](phase-4-api-routes.md) | Merged | [#7](https://github.com/prosdevlab/graphweave/pull/7), [#8](https://github.com/prosdevlab/graphweave/pull/8) |
| 5 | [Exporter + Remaining Tools + SSRF Transport](phase-5-exporter-tools-ssrf.md) | In progress | — |
Loading
Loading