Commits

main

media.analyze, local-first media analysis (roadmap WS-O task 5). A new step kind, media_analysis (server/workflows/media-analysis.js), behind the workflow media.analyze (server/workflows/media.js, namespace media; Live may run it through the default AI_NS_FALLBACK). A VOD, clip or audio file is fetched like any media input: allow-listed hosts only, into media-tmp beside the database (never /tmp, which is memory on the production host), capped at 4 GB and at that disk's free space less a 3 GB reserve, refused with media.no_space before downloading. Everything runs on this host, one analysis at a time, at nice 15. (1) Signals come from one FFmpeg pass, video decoded at keyframes only: scene changes (scdet), black and frozen picture, silence, and loudness (integrated, range, the typical level, i.e. the median audible second, since one burst drags the gated integrated level up, and loud moments at least 6 LU above it). (2) Scenes come from the changes. (3) Speech is whisper.cpp through live.stt. (4) Highlights are windows scored by loud, scene changes and speech, each with its reasons and transcript excerpt. (5) The overview comes from a local model (new provider `local`, any OpenAI-compatible server on this host, AI_LOCAL_LLM_URL, route media.local), else it is extractive from the measured facts. A paid provider (route media.paid) writes it only with allow_paid and an active quota with workflow_prefix media.paid and a max_cost_usd while today's media.* spend is under it; that quota gates only this call (quotas.paidBudget), never runs. overview.source names the writer, gaps list what is missing, and the output is not cached. test/media-analysis.test.js: the log parser; a real run on a 28 s fixture (cuts, black, still picture, silence, a loud burst) with a fake local model that sees only the facts; the local model down -> extractive and said; paid refused without allow_paid, without a budget and past it, used within it; too little disk refused before any download. workflows.test runs it on the fixture too (both skip the runs without ffmpeg). npm test 19/19.OpenVibers · 27 Sept 2026 67fb2a4
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 c3ee605
Seed workflow tools.describe (roadmap WS-O task 11): a draft description of one tool from its descriptor (summary, how-to, inputs and outputs, limits, FAQ), every statement cited to the descriptor and unknowns in gaps, never auto-published; route alias tools.describe. The plan's other seeds exist (wiki.generate_page, news.summarize_story, reviews.summarize_entity, deals.enrich_deal, trade.summarize_market_context, and coupons.extract_coupon and codes.generate_docs under those names)OpenVibers · 26 Sept 2026 855eca0
Operator console (roadmap WS-O task 4): /console on ai.openvibe.network, server-rendered with no JavaScript, for OpenVibe.Network staff. Providers (secret reference names and whether they resolve, never a value; base URLs without query or user info), models, routes with their fallbacks in order, templates and workflows with every version, its status and the version in use; runs with status tabs and filters (workflow, requester, error code, UTC time range), failures by error code, and a run page (versions, provider/model, fallback, attempts, tokens, cost, error, grounding, citations, the hash-only request log, and the stored input/output bounded: strings cut at 240 characters, lists at 20 items, credential-named keys blanked); quotas with their current windows, usage by day/requester/workflow/model; cache entries and hits; the audit log by kind, action, actor and target. Sign-in is Network SSO (authorization code + PKCE S256 as OAuth client `ai`, refresh token revoked at once) with Billing's session scheme (__Host- cookie, only its hash stored in console_sessions, 60 min, CSRF token plus same-origin check on every POST, sanitizeNext keeps next on /console and sends control characters and backslashes home). The token's staff claims map to AI's capability ids and are re-mapped on every request: staff.site.view (admin, owner) -> ai.usage.read, staff.ai.manage (admin, owner) -> ai.workflow.manage (version status, cancel a run), staff.secrets.manage (owner) -> ai.provider.manage (provider enable/disable, circuit reset, quotas, cache purge); a global_mod or user gets 403 and no session. Writes reuse the admin API's functions (provider status, circuit reset, cache purge and the status summary move to server/ops.js, shared by both), so each writes the same audit_log row with the person as actor; sign-ins, sign-outs and refusals are audited as console.*. Strict CSP (one hashed stylesheet), noindex, no-store, GET /robots.txt disallows /console, /auth/ and /api/; the nginx reference vhost proxies /console, /auth/ and /robots.txt with the client address from $remote_addr. 503 in production without AI_CONSOLE_SESSION_SECRET or OV_OAUTH_CLIENT_SECRET. Checked in headless Chrome at 390/768/1280 px (no horizontal overflow, wide tables scroll in their container) and with axe (WCAG 2.1 AA, light and dark): no violations. test/console.test.jsOpenVibers · 26 Sept 2026 86e1246
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 baedda1
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 1452cd7
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 ce1f414
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 779a031
nginx: the commented template for exposing /api/ sets the client-IP headers from $remote_addr (X-Real-IP, X-Forwarded-For, CF-Connecting-IP), like every active location, instead of $proxy_add_x_forwarded_for, which passes a client-sent X-Forwarded-For through if someone uncomments it (browser-check follow-up, WS-Q task 3; the active locations already set all three). Comment onlyOpenVibers · 26 Sept 2026 f7be9bd
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 3fc0b18
Citations or explicit gaps on every run (WS-O task 3): each run records grounding { cited, gaps }: the source ordinals its output cites, and the gaps it names; an output that cites nothing and names no gap gets one written for it (no sources, or sources not cited), so nothing reads as verified when it is not. Covers live.* and network.site_copy like every other workflow; a cached run carries the grounding of the run it reuses; runs.grounding is an added columnOpenVibers · 26 Sept 2026 5451f85
Graceful stop stops the ai.run.* relay (WS-P lifecycle follow-up): close() (SIGTERM) now, after runs.drain() has queued the last run events, stops the events outbox and awaits its send in progress (events.stop(); unsent rows stay for the next start) and clears its prune timer, before the database closes; it used to keep relaying until the exit. test/events.test.js: close() leaves the relay stopped and the unsent rows in the outboxOpenVibers · 26 Sept 2026 dc75e16
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 8038305
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 bc5b78d
Pins: openvibe-contracts 0.41.0 → 0.42.0, openvibe-sdk 0.7.0 → 0.9.1, openvibe-shared 1.7.0 → 1.12.0; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 53f7765
AI's user modules (Contracts 0.41.0, WS-B task 9): a run on a person's behalf follows their ai.preferences (style, length and perspective reach the system prompt; history: false keeps neither the input nor a cache entry; shaped output is never cached for reuse); ai.usage_summary (30-day runs, tokens, services) written as the owner by a 5-minute scan and a daily refresh, only when it changedOpenVibers · 25 Sept 2026 e2847c9
ai.run.* events (W13 gate): queued, cached, succeeded and failed runs each queue their openvibe-contracts ai.run.<status>@1 event in the same transaction as the state change (succeeded with its citations; interrupted runs at boot too), published by an openvibe-sdk outbox with AI's service token; internal visibility, ids, workflow, requester, usage and counts only, never input or output. EVENTS_URL enables it. test/events.test.jsOpenVibers · 24 Sept 2026 b2ea9d1
One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts onlyOpenVibers · 24 Sept 2026 bc26762
CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those stepsOpenVibers · 24 Sept 2026 beee294
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 a6d4f39
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 f034a9f
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026 772262c
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 3a480ac
Track O: /metrics for direct loopback callers and a truthful /api/ready (openvibe-shared v1.3.0)OpenVibers · 23 Sept 2026 96dc8a3
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 b92f5ef
Run queue caps: a run that would wait for a slot is refused 429 queue.full (problem+json, Retry-After) once its caller already has AI_MAX_QUEUED_RUNS_PER_CALLER runs waiting (default 50) or the queue holds AI_MAX_QUEUED_RUNS (default 200), checked before quota so a refused run leaves no row and spends nothing; one caller can no longer fill the queue for every otherOpenVibers · 23 Sept 2026 bdca064
Schema cache: the compiled-validator cache shared by every caller (ai.extract/ai.enrich schemas are caller-supplied) is an LRU capped by entry count and total schema bytes (AI_SCHEMA_CACHE_MAX=500, AI_SCHEMA_CACHE_MAX_BYTES=8 MiB); evicted and failed schemas are removed from Ajv's own cache too, and a schema larger than the byte budget is compiled for that call onlyOpenVibers · 23 Sept 2026 549ec14
Fetcher: a redirect from a public allow-listed host may not reach the internal Media origin. Every hop was judged, but judge() let the internal origin through on any hop, so an allow-listed host that redirects could make the service fetch from loopback Media; now only a hop that is itself internal may redirect there (tests script redirect chains through a transport seam)OpenVibers · 23 Sept 2026 690b068
Namespaces fail closed: a token without an ns claim no longer runs every namespace's workflows. A service token (svc:<id>) without ns falls back to its AI_NS_FALLBACK entry (default live=live.*|network.site_copy, since Network grants Live's ai.run.create with no namespaces), else <id>.*; app and module tokens get nothing; AI_NS_REQUIRED=false is a rollback leverOpenVibers · 23 Sept 2026 f75c66b
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 8928289

More commits