Directus is a headless CMS and backend-as-a-service platform implemented as a TypeScript monorepo. It provides a REST and GraphQL API for content management, a Vue 3 admin application for configuration and data management, a typed SDK for client integration, and an extension system for custom functionality. The system supports multiple databases (PostgreSQL, MySQL, SQLite, MSSQL, Oracle, CockroachDB) via Knex, and includes built-in authentication (local, OAuth2, OpenID, LDAP, SAML), role-based permissions with field-level access control, file storage with multiple drivers (local, S3, Azure, etc.), and a flows automation engine. Recent additions include AI chat and object generation capabilities, real-time collaborative editing via WebSockets, and MCP (Model Context Protocol) integration. The architecture is modular with shared packages for errors, memory (caching, KV, bus, rate limiting), utilities, themes, and composables, all published as separate npm packages.
acpx is a headless CLI client and runtime for the Agent Client Protocol (ACP), enabling orchestration of AI agent sessions with persistent state, multi-step flow execution, permission policies, and a replay viewer for auditing. The architecture combines a CLI entry point, an embeddable runtime (AcpRuntime), a queue-based IPC system for shared session access, and a separate React-based replay viewer for inspecting flow run bundles. It supports 20+ built-in agents (Claude, Gemini, Cursor, etc.) via ACP, manages session persistence as JSON files with event logs, and provides output formatting in text, JSON, or quiet modes. The codebase is predominantly TypeScript with extensive test coverage (85%+), conformance testing against the ACP specification, and platform-specific process management for Windows and POSIX systems.
Claw Code is a production-grade CLI application for AI-assisted coding, built primarily in Rust with a complementary Python parity workspace. It serves as a local agent harness that integrates with multiple LLM providers (Anthropic, OpenAI, xAI, DashScope, local OpenAI-compatible), manages conversational sessions, enforces workspace-scoped permissions, supports the Model Context Protocol (MCP) for external tool integration, and provides a plugin system for lifecycle hooks. The architecture is a multi-crate Rust workspace under `rust/`, with the main binary `claw` (from `rusty-claude-cli`), a core runtime crate (`runtime`) handling session persistence, permission enforcement, conversation loops, and MCP plumbing; an API client crate (`api`) for provider dispatch and streaming; a plugins crate for lifecycle management; and supplementary crates for tools, telemetry, and a workspace RAG service. The Python workspace (`src/`) is explicitly a non-production porting/parity mirror of a TypeScript archive, used for surface mapping and audit. The Rust code is well-structured, extensively tested, and demonstrates strong engineering practices—clean abstractions, reusable components, and defense-in-depth security (path validation, read-only command heuristics, approval tokens). Notable highlights include a permission enforcer with workspace boundary enforcement, a modular MCP client supporting multiple transports, a plugin system with manifest validation, and a session store with JSONL rotation and workspace fingerprint isolation. The repository is actively maintained (CI workflows, issue triage, recent commits) and shows low technical drift, though some modules have `#[allow(dead_code)]` annotations and the parity workspace adds maintenance overhead.
laravel-governor is a Laravel package that provides role-based access control (RBAC) with team and ownership support. It integrates with Laravel's native authorization system via policies and gates, offering granular permission management through an admin interface built with Blade templates and Alpine.js. The package includes Eloquent models for roles, permissions, actions, ownership, entities, groups, teams, and assignments, along with migrations, seeders, Artisan commands for setup and publishing, and traits (Governing and Governable) to add authorization capabilities to User and other models. It features a caching layer with automatic invalidation via observers to optimize permission checks, and uses middleware to dynamically register custom policy methods via reflection. The architecture follows Laravel conventions with service providers for booting, controllers for handling requests, and policies for authorization logic.
Figura is a Minecraft mod (client-side with optional server-side backend) that allows players to fully customize their avatar's appearance, animations, sounds, particles, and behavior using Lua scripting. The architecture is a multi-loader (Fabric, Forge, Quilt, NeoForge) client mod with a server-side plugin (Spigot) for avatar storage, permissions, and networking. The client-side core includes a Lua runtime (LuaJ) with a sandboxed API exposing over 30 modules (e.g., models, textures, sounds, events, keybinds, action wheel, networking, math). Avatars are defined by Blockbench models, Lua scripts, textures, and sounds, all packaged into NBT files. The rendering pipeline hooks into Minecraft's vanilla rendering via extensive mixins to replace player models, modify armor, cape, elytra, and nameplates. The server-side backend (Figura Server Bridge) provides avatar upload/download, user data, pings, and permission management via WebSocket or custom Minecraft packets. Key entry points include the `Avatar` class (lifecycle), `FiguraLuaRuntime` (script execution), `AvatarRenderer` (rendering), `PermissionManager` (access control), and `NetworkStuff` (backend communication). External dependencies include LuaJ, Gson, nv-websocket-client, and Minecraft's own libraries.
ACI.dev is an open-source platform that provides a unified tool-calling interface for AI agents, enabling them to interact with over 600 third-party services via REST APIs or custom connectors. The backend is built with FastAPI, PostgreSQL (with pgvector for semantic search), SQLAlchemy, and Alembic for migrations, while the frontend is a Next.js 15 application with Shadcn UI, TanStack Query, and Zustand. The platform includes a full OAuth2 flow for service authentication, encrypted credential storage using AWS KMS, Stripe-based subscription billing, and a CLI for administrative tasks. It is designed as a multi-tenant SaaS with per-project quotas, agent management, and a playground for testing function calls. Architecturally, the system is modular: apps are defined as JSON schemas (app.json and functions.json) in a standardized format, and a generic execution engine dispatches calls to REST endpoints or local connector modules. The codebase demonstrates strong separation of concerns with CRUD modules, dependency injection, and middleware for rate limiting and logging. It also includes an evaluation pipeline for measuring search relevance (using synthetic intents and metrics like MRR), and a vector-based search for app and function discovery. While primarily an application, the repository contains research-oriented components such as the evaluation pipeline and embedding-based search, reflecting a hybrid nature focused on improving AI agent tool selection. The code is well-maintained and actively developed, with comprehensive test coverage (though some tests are skipped or TODO). The integration system is extensible, and several components (e.g., OAuth2 manager, encrypted SQL types, generic data table UI) are well-crafted and reusable. However, the codebase shows some technical debt in the form of hardcoded configurations, in-memory rate limiting, and app-specific OAuth2 overrides. Overall, it is a professional-grade platform with a high level of craftsmanship, suitable for production use and further extension.
django-wiki is a full-featured wiki system built as a reusable Django application. It provides hierarchical wiki pages with URL slug paths, revision control, attachments, images, notifications, and granular permissions. The architecture is modular, with a plugin system that allows extensions like macros, image galleries, and notification digests. Content is authored in Markdown with custom extensions for wiki links, tables of contents, and code highlighting. The system integrates with Django's authentication, sites framework, and admin interface. It is designed for production use with caching, spam protection, and i18n support. The codebase is well-structured with clear separation of concerns, though it carries some technical debt from vendored frontend assets and deprecated patterns.
Gitolite is a Perl-based Git repository management system that provides fine-grained access control, mirroring, and extensibility through a plugin architecture. It operates as a layer on top of plain Git, intercepting SSH and HTTP connections to enforce repository-level and branch-level permissions. Key entry points include `src/gitolite` (CLI) and `src/gitolite-shell` (SSH/HTTP handler). The system compiles a central configuration file into a cached Perl data structure, then uses triggers and VREFs (virtual refs) to enforce rules during push and access operations. Internally, the architecture is modular: core libraries (`Rc.pm`, `Conf/Load.pm`, `Conf/Store.pm`) handle configuration loading and access checks; triggers (e.g., `Mirroring`, `Writable`, `Shell`) extend behavior at lifecycle points; and commands provide admin and user-facing operations. The trigger system and VREF pattern allow third-party extensions without modifying core code. The project includes a substantial test suite with a custom testing DSL (`Tsh.pm`) that simulates SSH and Git operations. External dependencies are minimal: Git, Perl 5.10+, and standard libraries. Optional integrations include Redis for caching, LDAP/FreeIPA for user groups, and HTTP servers for smart-HTTP. The codebase is mature and battle-tested, with over a decade of production use, though some contrib scripts and advanced features (e.g., `EMAIL-CHECK`, `refex-expr`) remain experimental or poorly documented.
This repository provides a full-stack demonstration of a permission management system using Spring Boot for the backend and Vue.js for the frontend. Despite its name, it does not use Apache Shiro; instead, it implements a custom, annotation-based permission control via AOP (RequiresPermissions annotation and PermissionAspect) and token-based authentication using Caffeine local cache. The backend is a monolithic Spring Boot 2.3.10 application with MyBatis for database access, serving a REST API. The frontend is a Vue 2 application (based on vueAdmin-template) with dynamic routing and ElementUI, featuring a custom directive for button-level permission checks. The system supports multi-role users, role-based menu and permission assignment, and a clean separation of concerns between backend and frontend permission enforcement. The codebase is well-structured and serves as a clear reference for implementing RBAC-like permission systems in Java+Vue projects, though it is not intended for production use without significant hardening and updates.