Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
1d681ac
Fix incorrect unused variable warnings in static analyzer
logbie Dec 11, 2025
58617aa
Refactor integration test runner to use PowerShell Jobs
logbie Dec 11, 2025
95ab084
Optimize scope handling with reference counting
logbie Dec 11, 2025
3149b1c
Updates error handling syntax
logbie Dec 11, 2025
07e8471
Format code for improved readability
logbie Dec 12, 2025
f9af5a8
Overhauls WflHash with a buffered sponge construction
logbie Dec 12, 2025
b847c34
Add DoS protection and binary hashing to crypto lib
logbie Dec 12, 2025
ad13a16
Improve cross-platform support in tests
logbie Dec 12, 2025
9040a0d
Adds 'input' function for user interaction
logbie Dec 12, 2025
064b8bc
Adds security warning to experimental crypto functions
logbie Dec 12, 2025
246e808
Docs: Formalize WFLHASH1 algorithm specification
logbie Jan 2, 2026
6f00bf0
Adds MCP server for AI assistant integration
logbie Jan 2, 2026
5ca2884
docs: Add WFL MCP server test report
logbie Jan 2, 2026
115a2df
Applies consistent code formatting
logbie Jan 2, 2026
cf039af
docs: Add mandatory git worktrees workflow to CLAUDE.md
logbie Jan 2, 2026
3d12987
ci: Allow all bots to trigger Claude Code reviews
logbie Jan 2, 2026
769675a
Register loop variables in the static analyzer
logbie Jan 2, 2026
720c692
Enable function invocation using parentheses
logbie Jan 2, 2026
206033e
Applies consistent code formatting
logbie Jan 2, 2026
7ab9bd7
Merge main into dev1
logbie Jan 2, 2026
a5e9c4c
Remove dev1-specific test for native function parens
logbie Jan 2, 2026
0e81e27
Remove duplicate unreachable LeftParen match arm
logbie Jan 2, 2026
2db07cf
Fix type checker for overloaded builtin functions
logbie Jan 2, 2026
8f6a81c
Refactor code for conciseness
logbie Jan 2, 2026
cc565c9
Fix clippy::collapsible_if warning
logbie Jan 2, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions .claude/settings.local.json
Original file line number Diff line number Diff line change
Expand Up @@ -39,9 +39,21 @@
"Bash(findstr:*)",
"Bash(powershell -Command \"(Get-Content ''G:\\Logbie\\wfl\\src\\parser\\tests.rs'').Length\")",
"Bash(git stash:*)",
"Bash(wc:*)"
"Bash(wc:*)",
"Bash(\"C:\\\\\\\\Program Files\\\\\\\\wfl\\\\\\\\bin\\\\\\\\wfl-lsp.exe\":*)",
"Bash(cargo search:*)",
"Bash(cargo doc:*)",
"Bash(./target/release/wfl-lsp.exe:*)",
"Bash(powershell -Command \"\\(Get-Content ''G:\\\\Logbie\\\\wfl\\\\src\\\\interpreter\\\\tests.rs''\\).Length\")",
"Bash(Select-Object -First 50)",
"Bash(powershell -Command \"cargo test test_zero_arg_native_function_with_explicit_parens 2>&1 | Select-Object -First 50\":*)",
"Bash(git worktree:*)",
"Bash(powershell -Command \"cargo test test_zero_arg_native_function_with_explicit_parens 2>&1 | Select-Object -First 60\")"
],
"deny": [],
"ask": []
}
},
"enabledMcpjsonServers": [
"wfl"
]
}
7 changes: 5 additions & 2 deletions .github/workflows/claude-code-review.yml
Original file line number Diff line number Diff line change
Expand Up @@ -37,9 +37,12 @@ jobs:
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

# Allow all bots to trigger Claude Code reviews
allowed_bots: '*'
Comment on lines +40 to +41

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat .github/workflows/claude-code-review.yml

Repository: WebFirstLanguage/wfl

Length of output: 3167


🌐 Web query:

anthropics/claude-code-action allowed_bots parameter

💡 Result:

The Claude Code Action supports an allowed_bots input (env var ALLOWED_BOTS / input name allowed_bots) that controls which GitHub bot accounts may trigger the action. By default it's empty (no bots allowed). You can set a comma-separated list of bot usernames (e.g., "dependabot[bot],renovate[bot]") or "*" to allow all bots. [1][2]

Example (workflow with input):

  • allowed_bots: "dependabot[bot],renovate[bot]"

Sources: Anthropic docs (Claude Code Action config) and action config/readme. [1][2]


Restrict allowed_bots from wildcard to specific trusted bots.

The allowed_bots: '*' parameter allows any bot account to trigger Claude Code reviews, creating unnecessary exposure to unauthorized or malicious bots. Since the default behavior is to allow no bots, using a wildcard significantly increases the security surface and API usage costs. Restrict this to specific trusted bots that legitimately need to trigger reviews:

🔎 Proposed fix
-          # Allow all bots to trigger Claude Code reviews
-          allowed_bots: '*'
+          # Allow specific trusted bots to trigger Claude Code reviews
+          allowed_bots: 'dependabot[bot],renovate[bot]'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Allow all bots to trigger Claude Code reviews
allowed_bots: '*'
# Allow specific trusted bots to trigger Claude Code reviews
allowed_bots: 'dependabot[bot],renovate[bot]'
🤖 Prompt for AI Agents
.github/workflows/claude-code-review.yml around lines 40-41: the workflow
currently uses allowed_bots: '*' which permits any bot to trigger Claude Code
reviews; change this to an explicit list of trusted bot accounts (e.g., CI and
automation bot names) by replacing the wildcard with an array of those bot
usernames or GitHub app identifiers, include only the minimum required bots, and
add a brief comment listing the owners/justification for auditability before
committing.


# Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4)
# model: "claude-opus-4-20250514"

# Direct prompt for automated review (no @claude mention needed)
direct_prompt: |
Please review this pull request and provide feedback on:
Expand All @@ -48,7 +51,7 @@ jobs:
- Performance considerations
- Security concerns
- Test coverage

Be constructive and helpful in your feedback.

# Optional: Use sticky comments to make Claude reuse the same comment on subsequent pushes to the same PR
Expand Down
144 changes: 144 additions & 0 deletions CLAUDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,150 @@ wfl --step program.wfl
scripts/install_vscode_extension.ps1
```

### MCP Server (AI Integration)
```bash
# Run LSP server for VSCode (default)
wfl-lsp

# Run MCP server for AI assistants (Claude Desktop, etc.)
wfl-lsp --mcp

# Test MCP server with example requests
# Windows:
.\wfl-lsp\examples\test_mcp_server.ps1
# Linux/macOS:
./wfl-lsp/examples/test_mcp_server.sh

# Build and run example MCP client
cargo run --example simple_mcp_client

# Test specific tool
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"parse_wfl","arguments":{"source":"store x as 5"}}}' | wfl-lsp --mcp

# List available tools
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | wfl-lsp --mcp

# List available resources
echo '{"jsonrpc":"2.0","id":1,"method":"resources/list"}' | wfl-lsp --mcp

# Read workspace files
echo '{"jsonrpc":"2.0","id":1,"method":"resources/read","params":{"uri":"workspace://files"}}' | wfl-lsp --mcp
```

**MCP Tools Available:**
- `parse_wfl` - Parse WFL code and return AST
- `analyze_wfl` - Run semantic analysis and return diagnostics
- `typecheck_wfl` - Check types and return errors
- `lint_wfl` - Lint code and suggest improvements
- `get_completions` - Get code completions at position
- `get_symbol_info` - Get symbol information at position

**MCP Resources Available:**
- `workspace://files` - List all WFL files in workspace
- `workspace://symbols` - Get all symbols across workspace
- `workspace://diagnostics` - Get all diagnostics across workspace
- `workspace://config` - Read .wflcfg configuration
- `file:///{path}` - Read specific file contents

**Documentation:**
- [MCP User Guide](Docs/guides/wfl-mcp-guide.md)
- [MCP API Reference](Docs/guides/wfl-mcp-api-reference.md)
- [Claude Desktop Integration](Docs/guides/claude-desktop-integration.md)
- [MCP Architecture](Docs/technical/wfl-mcp-architecture.md)

## Git Workflow with Worktrees

**MANDATORY: Always use git worktrees when working on WFL tasks.**

Git worktrees allow you to work on multiple branches simultaneously without switching branches in your main working directory. This is the required workflow for all WFL development.

### Creating a Worktree for a New Task

```bash
# Create a new worktree for a feature/bugfix
git worktree add ../wfl-feature-name -b feature-branch-name

# Create a worktree from an existing branch
git worktree add ../wfl-existing-branch existing-branch-name

# Example: Create worktree for adding new stdlib function
git worktree add ../wfl-add-sqrt -b feature/add-sqrt-function
```

### Working in a Worktree

```bash
# Navigate to your worktree
cd ../wfl-feature-name

# Work normally - build, test, commit
cargo build
cargo test
git add .
git commit -m "feat: Add new feature"

# Push your changes
git push -u origin feature-branch-name
```

### Committing and Cleaning Up When Done

**CRITICAL: Always commit your work and clean up worktrees when finished.**

```bash
# 1. Commit all changes in the worktree
git add .
git commit -m "Your commit message"
git push

# 2. Return to main repository
cd ../wfl

# 3. Remove the worktree
git worktree remove ../wfl-feature-name

# Or if the worktree has uncommitted changes you want to discard:
git worktree remove --force ../wfl-feature-name

# 4. List all worktrees to verify cleanup
git worktree list
```

### Best Practices

1. **One worktree per task**: Create a new worktree for each feature, bugfix, or experiment
2. **Descriptive names**: Use clear names like `wfl-fix-parser-bug` or `wfl-add-crypto`
3. **Clean up promptly**: Remove worktrees after merging or abandoning work
4. **Commit before removing**: Always commit or stash changes before removing a worktree
5. **Location convention**: Place worktrees as siblings to main repo (`../wfl-*`)

### Common Worktree Commands

```bash
# List all worktrees
git worktree list

# Remove a worktree
git worktree remove <path>

# Force remove (discards uncommitted changes)
git worktree remove --force <path>

# Prune stale worktree references
git worktree prune

# Move a worktree to a new location
git worktree move <old-path> <new-path>
```

### Why Worktrees?

- **Parallel development**: Work on multiple branches simultaneously
- **Clean state**: Each worktree has its own working directory and index
- **No context switching**: No need to stash/unstash or switch branches
- **Build isolation**: Separate build artifacts for each worktree
- **Safety**: Prevents accidentally committing to wrong branch

## Architecture Overview

WFL is a natural language programming language implemented in Rust with a traditional compiler pipeline enhanced for async execution.
Expand Down
1 change: 1 addition & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading