chore(deps): bump starlette from 1.0.0 to 1.3.1 - #11
Open
dependabot[bot] wants to merge 55 commits into
Open
Conversation
Expose rat search and list_repos as stdio MCP tools so editors and agents can query the reusable asset store directly. Refactor list/search handlers to share core logic via run_list / run_search. Add a mise task to build and upload the macOS arm64 binary to the GitLab generic package registry.
Track per-repo branch and indexed commit in a new repos table, with files.repo_id FK cascading deletes through to snippets. Purge now removes the repo row (which cascades) and reports deleted file/snippet counts captured before the delete. Move all SQL out of rat-lambda and rat-api into rat-core::queries so the schema lives in one place. Add branch to FileMessage so ingest can populate the repos row, and surface branch and commit in CLI/MCP list output.
… fields Publish the migration Lambda ARN to SSM and grant the Cognito authenticated role invoke permission so the new `rat migration` command can trigger it. Add a reset flag on the migration Lambda that drops the schema before re-running, accessed via `rat migration --reset` with an arrow-key confirm. Add a RepoCreate action in rat-api for synchronous repo upsert from the CLI ingest flow, and extend the repos table with description, embedding, and a generated tsvector so repos support the same hybrid search pattern as snippets. Drop the now-unused files.commit_id column.
Drive ingest from the current repo state: classify via RepoGet, pick Full vs Incremental, and upsert repos synchronously so the Lambda consumer can drop its per-file repo upsert and the branch/commit fields from FileMessage. SQS Action::Purge is gone; purge is API-only. indexed_commit_id becomes nullable so a created-but-not-finalized repo is a distinct state that the next ingest recognizes and recovers from. Centralize shared plumbing: rat-core::api holds every request/response DTO and the ApiRequest/ApiResponse enums, consumed by both rat-api and rat-cli. rat-cli gains api_client, sqs, and session modules so every command boils down to `CliSession::init` plus the action-specific call. Split ingest internals (RepoState, prompt_mode, send_all_messages, confirm helper) and move SourceType::from_path and git::short_commit next to their types.
Silently fall back to the detected repo root instead of erroring out, and replace the per-state confirmation prompts with a single final "Proceed?" confirm. plan_mode prints the plan but doesn't ask, and AlreadyIndexed now exits quietly as a no-op. Also bumps the consumer SQS batch size to 3.
On the final RepoUpsert the CLI sends the repo's README and the API Lambda runs it through the summarizer and embedder, storing a plain 2-3 sentence description and a vector on the repo row. Provision a summary_model_id and longer timeout on the API Lambda so the extra LLM call fits the synchronous upsert flow. Drop the truncation on rat list and print the full description unindented, letting the terminal wrap.
Add RepoSearch API backed by hybrid FTS + vector queries on the repos table and surface it through a new --scope flag on rat search (code default, doc, repo) plus a matching search_repos MCP tool. list_repos tool output now includes the description block, and the CLI list adds a blank line between repos. Introduce rat-cli::highlight, a tree-sitter-highlight based terminal renderer with a style stack for correct nested resets, bold/italic attributes, and distinct colors for 40+ capture names across rust, js, ts, python, go, java, and markdown. rat chunk drops the [imports] header and pipes content through the highlighter; rat search does the same for snippet bodies and no longer prints the LLM description line. Bump lambda_runtime to 1.x and hoist it into the workspace dep table.
tree_sitter_typescript::HIGHLIGHTS_QUERY only covers TS-specific captures and relies on an `; inherits: javascript` directive that tree-sitter-highlight does not process, leaving strings, comments, functions, and numbers uncolored. Concatenate the JS highlight query so the shared captures render properly.
- Replace root README planning doc with actual workspace layout, build/run instructions, and MCP setup for Claude Code and Kiro - Delete stale ingestion-cli.md (pre-coding plan diverged from code) - Expand packages/rat/README with ingest state machine, API surface, DB schema, hybrid search (RRF), Lambda processing, and config/auth
cargo pkgid output format varies across cargo versions, breaking the sed-based version extraction. Use cargo metadata + jq for a stable lookup and fail fast if the version cannot be resolved.
- Scaffold packages/frontend (SolidJS + Vite + Tailwind) - Add FrontendStack: private S3 bucket behind CloudFront (OAC), SPA fallback, access logging, checkov suppressions for CDK-generated BucketDeployment helpers - Create dedicated Cognito UserPoolClient + IdentityPool for the web app so AuthStack's CLI client stays untouched - Publish runtime-config.json (Cognito IDs + API Lambda ARN) to the asset bucket via BucketDeployment + SSM dynamic refs - Reverse stack order to Network > Storage > Auth > Application > Frontend, eliminating the cycle that the Distribution callback URL + Cognito provider wiring would have introduced - Grant web role the same baseline permissions as the CLI role via identity-based policies referencing SSM dynamic refs - Align Vite version across workspace, ignore *.tsbuildinfo - Add ux.md: grep.app-inspired search UI design for rat Co-Authored-By: Claude <noreply@anthropic.com>
Returns the full file row (id, repo_id, source_path, content, language) for a given (repo_id, source_path) pair, or null when not found. Intended for the search UI's "open full file" flow from a snippet result. Co-Authored-By: Claude <noreply@anthropic.com>
…lient - Add mise task `frontend:runtime-config` to fetch Cognito + API SSM params and write packages/frontend/public/runtime-config.json - Bootstrap SolidJS app with oidc-provider-solid (Cognito OIDC via User Pool discovery endpoint) - Add typed rat-api client: LambdaClient + Cognito Identity Pool credential provider, InvokeCommand wrapper, convenience helpers (search, listRepos, searchRepos, getRepo, getFile) mirroring rat-core's ApiRequest/ApiResponse shapes - Landing page: header with sign in / user email, centered search input, browse section listing indexed repos (repo_id + snippet count + line-clamped description) via listRepos - Add @/ path alias (vite + tsconfig), cn() helper using clsx + tailwind-merge - Rename HTML title to "rat - reusable assets toolkit" Co-Authored-By: Claude <noreply@anthropic.com>
- Router setup with @solidjs/router; Landing navigates to /search?q=... on submit; /search is an explicit route, everything else falls back to Landing - Shared Header and SearchInput components so both pages render the same brand + auth controls, with the input promoted into the header on the results page - /search page fans out to repo_search and search in parallel and renders two stacked sections: top N repos (limit 3) with a min-max normalised unicode relevance bar, and snippet cards below - ResultCard: repo/path header, LLM description line, code body for source_type=code (Prism with a minimal indigo/emerald/orange theme over a grayscale base) and prose body for docs - URL ↔ input sync via on(() => params.q, ...) so typing in the header doesn't get reset by the reactive effect Co-Authored-By: Claude <noreply@anthropic.com>
…ults - Add /file?repo=X&path=Y route backed by rat-api's file_get action - Parse snippet descriptions (SUMMARY/IDENTIFIERS/KEYWORDS) and render summary as the card blurb plus KEYWORDS as subtle border chips - Strip line-clamp on repo descriptions in search (show in full) - Clickable source path in result cards carries start/end line params; /file reads those, wraps each line in a block span, highlights the range with bg-yellow-50, and scrolls the first line into view on mount Co-Authored-By: Claude <noreply@anthropic.com>
Expose file enumeration per repo and snippet enumeration per file so the frontend can render a repo file tree and per-file chunk metadata.
Add /repo route with a file tree (auto-expanded to a deep-linked path) and link repo names from landing/search. On the file page, fetch snippets to surface a chunk panel: hovering a chunk highlights its range, clicking opens a side panel with summary/keywords. Extract the shared description parser into lib/description.ts.
Add @nxlv/python to the workspace and generate a uv-managed Python package for the AgentCore runtime. The agent uses a Strands agent backed by Claude Sonnet 4.6 on us-east-1 and streams responses via the BedrockAgentCoreApp entrypoint. Docker build context is configured for CDK asset packaging.
Add AgentStack that builds the packages/agent Docker image as an ARM64 AgentCore Runtime with Bedrock invoke permissions, and register its ARN in SSM. Frontend stack grants the authenticated role InvokeAgentRuntime and embeds the ARN in runtime-config.json for the SPA. Mise tasks updated to include the new stack and fetch the ARN for local dev runtime-config.
Move api_client out of rat-cli into a new rat-client crate so the API calling logic can be shared by clients beyond the CLI binary, then introduce rat-mcp as a Lambda binary that exposes the asset store as MCP tools (search, search_repos, list_repos, file_get) via AgentCore Gateway. rat-cli's cmd helpers now wrap rat_client::ops, and a file_get tool is also added to the existing stdio MCP server.
Deploy rat-mcp as a Rust Lambda and register it as an MCP target on a new AgentCore Gateway (IAM-authorized) in agent-stack. The gateway URL is exposed to the AgentCore Runtime via MCP_GATEWAY_URL, and the Strands agent connects to it using a SigV4-signed streamable-HTTP MCP client so the agent can list and invoke the rat tools. The system prompt is updated to describe the asset-discovery role, and the runtime entrypoint now also streams tool_use events.
Move rat-mcp Lambda and AgentCore Gateway from agent-stack into a dedicated mcp-stack that owns two gateways sharing one Lambda target: an IAM-authorizer gateway for the internal Runtime and a Cognito JWT gateway fronted by @drskur/dcr-proxy for external MCP clients. The proxy now also forwards /mcp traffic and rewrites the upstream WWW-Authenticate header so clients discover the proxy as the auth server. Auth-stack exposes the Cognito user-pool domain for the proxy and adds CfnOutputs for the values written into rat config. Callback URLs on the new confidential McpProxyClient cover Claude Code, Kiro CLI/IDE, and Claude Desktop / claude.ai.
Use a single fixed callback URL for Kiro CLI (oauth.redirectUri) instead of rotating through a fallback port list, add PHONE OAuth scope, and bump @drskur/dcr-proxy to 0.0.9. Document remote MCP setup for Claude Code, Kiro CLI, and Claude Desktop in README.
Switches to @drskur/oidc-provider-solid 0.1.12, which exposes the UserManager and subscribes to its events so expired tokens are refreshed in the background instead of forcing a page reload to recover the session. rat-api and agent-api now share that single UserManager and trigger signinSilent on demand when the cached token has expired. Adds a silent-callback entry for the renew iframe.
- Run agent container as non-root appuser (CKV_DOCKER_3) - Skip CKV_DOCKER_2 globally (HEALTHCHECK handled by AgentCore /ping) - Enable HTTP API access logging on AuthProxy stage (CKV_AWS_95) - Suppress CKV_AWS_158/149 for AuthProxy LogGroups and Cognito secret
Replace the mermaid ingestion pipeline with a drawio-based SVG and introduce a new architecture diagram covering the runtime topology (Frontend, AgentCore Runtime/Gateway, MCP, Cognito, Identity Pool).
Bump vite to >=7.3.2 to resolve the dev-server file-read advisories, and add pnpm.overrides for transitive packages (tar, handlebars, serialize-javascript, picomatch, axios, fast-xml-parser, ip-address, hono) that are otherwise pinned by upstream tooling. pnpm audit now reports no known vulnerabilities.
Picks up routine point releases for aws-config, aws-runtime, and the aws-sdk-* crates along with their aws-smithy-* support libraries.
Constrain python-multipart to >=0.0.27 via tool.uv.constraint-dependencies to pull the fix for GHSA-pp6c-gr5w-3c5g, since the package is only reached transitively through mcp. uv audit reports no known vulnerabilities.
Override fast-uri (<=3.1.1 → >=3.1.2) and @babel/plugin-transform-modules-systemjs (<=7.29.3 → >=7.29.4).
Remove deployed binary download links and Cognito values from README, and replace hardcoded DCR proxy endpoint and OAuth callback ports with placeholders so users substitute their own deployed values.
Bumps [rand](https://github.com/rust-random/rand) from 0.10.0 to 0.10.1. - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](rust-random/rand@0.10.0...0.10.1) --- updated-dependencies: - dependency-name: rand dependency-version: 0.10.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.3...2.7.0) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…rand-0.10.1 chore(deps): bump rand from 0.10.0 to 0.10.1 in /packages/rat
chore(deps): bump urllib3 from 2.6.3 to 2.7.0
Bumps [idna](https://github.com/kjd/idna) from 3.11 to 3.15. - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.11...v3.15) --- updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Prebuilt binaries are not distributed (aws-samples policy), so document how to build the rat CLI from source. - Add docs/BUILD.md: rustup setup, cargo build/run, cargo install, and a Docker-based Windows build (cross-compiles to x86_64-pc-windows-gnu with mingw-w64, no host Rust required) - README: note that prebuilt binaries are not provided, build with -p rat-cli, and link to docs/BUILD.md
docs: add build-from-source guide for the rat CLI
chore(deps): bump idna from 3.11 to 3.15
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.0 to 1.3.1. - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.0.0...1.3.1) --- updated-dependencies: - dependency-name: starlette dependency-version: 1.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
drskur
force-pushed
the
main
branch
2 times, most recently
from
July 24, 2026 06:48
a46887b to
254b87a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps starlette from 1.0.0 to 1.3.1.
Release notes
Sourced from starlette's releases.
... (truncated)
Changelog
Sourced from starlette's changelog.
... (truncated)
Commits
8ebffd0Version 1.3.1 (#3330)25b8e17EnforceFormParserlimits in parser callbacks (#3331)dba1c4bEnforcemax_fieldsandmax_part_sizeinFormParser(#3329)45e51dcUseStarletteDeprecationWarninginstead ofDeprecationWarning(#3119)5f8610cVersion 1.3.0 (#3327)167b585Buildrequest.urlfrom structured components (#3326)3730925Useremoveprefixto strip weak ETag indicator inis_not_modified(#3193)e6f7ad1avoid collapsing exception groups from user code (#2830)115228fAnnotate URLPath protocol parameter with Literal (#3285)113f193docs: replace inline ASGI server list with link to canonical implemen… (#3204)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.