Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions .github/workflows/pages.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
name: Deploy T1 Chat demo

on:
push:
branches:
- main
paths:
- "apps/t1code-demo/**"
- ".github/workflows/pages.yml"
workflow_dispatch:

permissions:
contents: read
id-token: write
pages: write
Comment on lines +12 to +15

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Scope permissions to the job that needs them.

id-token: write and pages: write are declared at the workflow level, granting them to the build job as well, which doesn't need them. Move these to the deploy job only.

🔒️ Proposed fix
 permissions:
   contents: read
-  id-token: write
-  pages: write
 
 concurrency:
   group: github-pages
   cancel-in-progress: false
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      pages: write
     environment:
       name: github-pages
🧰 Tools
🪛 zizmor (1.26.1)

[error] 14-14: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level

(excessive-permissions)


[error] 15-15: overly broad permissions (excessive-permissions): pages: write is overly broad at the workflow level

(excessive-permissions)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pages.yml around lines 12 - 15, The workflow-level
permissions in pages.yml are too broad because id-token: write and pages: write
are inherited by the build job; move those permissions into the deploy job only
and keep the top-level permissions limited to read-only access. Update the
workflow’s permissions block and the deploy job definition so the build job no
longer receives deployment privileges.

Source: Linters/SAST tools


concurrency:
group: github-pages
cancel-in-progress: false

jobs:
build:
runs-on: ubuntu-latest

steps:
- name: Check out repository
uses: actions/checkout@v5
Comment on lines +26 to +27

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Set persist-credentials: false on checkout.

The build job only compiles the wasm demo and never pushes; persisting the checkout token is unnecessary credential exposure.

🔒️ Proposed fix
       - name: Check out repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Check out repository
uses: actions/checkout@v5
- name: Check out repository
uses: actions/checkout@v5
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 26-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pages.yml around lines 26 - 27, The checkout step in the
pages workflow is leaving GitHub credentials on disk even though the build job
only compiles the wasm demo and never pushes anything. Update the
actions/checkout usage in the workflow to disable credential persistence by
setting persist-credentials to false on the existing checkout step, so the build
job does not retain unnecessary auth tokens.

Source: Linters/SAST tools


- name: Set up Rust
uses: dtolnay/rust-toolchain@stable
with:
targets: wasm32-unknown-unknown

- name: Cache Rust builds
uses: Swatinem/rust-cache@v2
with:
workspaces: apps/t1code-demo -> target

- name: Install Trunk
run: cargo install trunk --version 0.21.14 --locked

- name: Build demo
working-directory: apps/t1code-demo
run: trunk build --release --public-url "/${{ github.event.repository.name }}/"
Comment on lines +42 to +44

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Avoid direct template expansion inside run:.

${{ github.event.repository.name }} is interpolated directly into a shell command. Pass it through an environment variable instead to avoid the injection pattern flagged by static analysis.

🔒️ Proposed fix
       - name: Build demo
         working-directory: apps/t1code-demo
-        run: trunk build --release --public-url "/${{ github.event.repository.name }}/"
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: trunk build --release --public-url "/${REPO_NAME}/"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Build demo
working-directory: apps/t1code-demo
run: trunk build --release --public-url "/${{ github.event.repository.name }}/"
- name: Build demo
working-directory: apps/t1code-demo
env:
REPO_NAME: ${{ github.event.repository.name }}
run: trunk build --release --public-url "/${REPO_NAME}/"
🧰 Tools
🪛 zizmor (1.26.1)

[error] 44-44: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pages.yml around lines 42 - 44, The Build demo step in the
pages workflow is interpolating github.event.repository.name directly inside the
trunk build command, which matches the flagged shell-injection pattern. Update
the workflow so the value is passed into the step via an environment variable,
then reference that variable in the run command in the Build demo job instead of
using direct template expansion.

Source: Linters/SAST tools


- name: Configure Pages
uses: actions/configure-pages@v5
with:
enablement: true

- name: Upload Pages artifact
uses: actions/upload-pages-artifact@v4
with:
path: apps/t1code-demo/dist

deploy:
needs: build
runs-on: ubuntu-latest
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}

steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ node_modules
*.log
*.tsbuildinfo
apps/*/dist
apps/*/target
.astro
packages/*/dist
.env
Expand Down
47 changes: 45 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,16 @@

[![License](https://img.shields.io/badge/license-MIT-111111?style=flat-square)](./LICENSE)
[![npm](https://img.shields.io/npm/v/%40maria__rcks%2Ft1code?color=111111&label=npm&style=flat-square)](https://www.npmjs.com/package/@maria_rcks/t1code)
[![GitHub](https://img.shields.io/badge/github-maria--rcks%2Ft1code-111111?style=flat-square&logo=github)](https://github.com/maria-rcks/t1code)
[![GitHub](https://img.shields.io/badge/github-ahzs645%2Ft1chat-111111?style=flat-square&logo=github)](https://github.com/ahzs645/t1chat)

<img src="./assets/repo/t1code-preview.webp" alt="t1code terminal UI screenshot" width="1000" />

_T3Code, but in your terminal._

</div>

## t1code (code mode)

Run instantly:

```bash
Expand All @@ -27,10 +29,51 @@ bun add -g @maria_rcks/t1code
Develop from source:

```bash
git clone https://github.com/maria-rcks/t1code.git
git clone https://github.com/ahzs645/t1chat.git
cd t1code
bun install
bun dev:tui
```
Comment on lines +32 to 36

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

cd t1code after cloning t1chat.git — directory name mismatch.

Both "Develop from source" snippets do git clone https://github.com/ahzs645/t1chat.git followed by cd t1code. Cloning that URL creates a t1chat directory (matching the repo name), not t1code, so following these instructions literally will fail with "no such file or directory."

📝 Proposed fix
 git clone https://github.com/ahzs645/t1chat.git
-cd t1code
+cd t1chat
 bun install
 bun dev:tui

(apply the same fix to the second occurrence)

Also applies to: 73-77

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 32 - 36, The setup instructions have a
repository/directory mismatch: after cloning via git clone in the “Develop from
source” snippets, the next step should cd into the directory created by that
clone, not the old t1code name. Update both occurrences in the README so the cd
command matches the cloned t1chat repository name and keeps the install/dev
steps consistent.


## t1chat (chat mode)

<div align="center">
<img src="./assets/repo/t1chat-preview.png" alt="t1chat terminal UI screenshot" width="1000" />
</div>

t1chat is a chat-focused mode that transforms the TUI into a conversational interface inspired by [T3 Chat](https://t3.chat). It features a pink/magenta/lavender theme, a flat thread list grouped by time, and a streamlined UI without code-specific tools.

### What changes in chat mode

- Sidebar shows a flat thread list grouped by time (Today, Yesterday, Last 7 Days, etc.) instead of nested projects
- "New Chat" button and thread search in the sidebar
- Title shows "T1 Chat" instead of "T1 Code"
- Git tools, diff viewer, Chat/Plan toggle, and Full access button are hidden
- Settings and temp chat toggle in the top-right corner
- Composer placeholder says "Type your message here..."
- Pink/magenta/lavender color scheme matching T3 Chat

### Run chat mode

If installed globally:

```bash
t1chat
```

Run instantly:

```bash
bunx @maria_rcks/t1code t1chat
```

Develop from source:

```bash
git clone https://github.com/ahzs645/t1chat.git
cd t1code
bun install
T1CODE_CHAT_MODE=1 bun dev:tui
```

<sub>Based on T3 Code by [@t3dotgg](https://github.com/t3dotgg) and [@juliusmarminge](https://github.com/juliusmarminge).</sub>
Loading