Commits

main

openvibe-shared v2.15.0 (was v2.13.2) (#14)OpenVibers · 8 Oct 2026 0dca4f6
openvibe-shared v2.13.2 (was v2.13.0) (#12)OpenVibers · 8 Oct 2026 7f13ce0
openvibe-contracts v0.112.0 (was v0.97.0) (#11)OpenVibers · 7 Oct 2026 3387540
Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#10)OpenVibers · 7 Oct 2026 633c3c2
openvibe-shared 2.12.0: the showcase home and the Frame footer set their font (they rendered serif) (#9)OpenVibers · 7 Oct 2026 2a7bcef
Pin openvibe-contracts v0.97.0 and drop the proposed-capability shim (#8)OpenVibers · 5 Oct 2026 deae9d2
Pin openvibe-shared v2.9.0 (from v2.6.0): showcase ring icons fill their slot (#7)OpenVibers · 5 Oct 2026 1919a9e
Merge pull request #6 from OpenVibers/agent/blog-t11-step-4b-openvibe-blog-221215-muudm79iOpenVibers · 4 Oct 2026 99ef3fd
Add /llms-full.txt and the home AI summary, bump openvibe-publishing…OpenVibers · 4 Oct 2026 de148d0
Merge pull request #5 from OpenVibers/agent/blog-t11-step-2-second-batch-125041-muttk10eOpenVibers · 4 Oct 2026 0e0f276
Render every Blog page through openvibe-publishing/layout on shellOpenVibers · 4 Oct 2026 281b384
Bump openvibe-shared v2.3.1 → v2.5.0 (#4)OpenVibers · 3 Oct 2026 4cd52ac
Serve Blog cache headers through openvibe-shared/cache-policy (#3)OpenVibers · 2 Oct 2026 9a335d2
Plan T1: move OpenVibe.Blog onto openvibe-sdk/service from… (#2)OpenVibers · 2 Oct 2026 17832d8
The Blog home opens with what OpenVibe.Blog is for (plan T11, D92; openvibe-shared v2.3.1 showcase): 'Write on OpenVibe', where to start (Start writing, or read the OpenVibe blog below), and the six things a blog really gets today (drafts and revisions, scheduling, feeds, Community comments, themes, VIP members-only posts); the official blog's posts follow unchanged. The kit's stylesheet is linked only on the home (cached; loaded styles-first on a boost swap). Home budgets raised as a decision (html 29 KB, css 17.5 KB). Suites green.OpenVibers · 29 Sept 2026 05b8bbb
Blog tells search engines when a page changes (plan T11, IndexNow): with INDEXNOW_KEY set the key file is served at /<key>.txt and an indexable page appearing, changing or going away pings the engines (its path and the sitemap); drafts, private and noindex pages never; unset, nothing is mounted or sent. A home-page performance budget runs in CI where there was none. Tests green (verified).OpenVibers · 29 Sept 2026 9d00e2b
Blog moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. The SSRF ratchet's lower bound follows the deleted sso.js. Both suites 25/25.OpenVibers · 29 Sept 2026 12380d2
Blog on the service kit (plan T1): sign-in is openvibe-sdk/sso createSsoClient (state + PKCE S256, server-side exchange, next limited to this site and the Network), service tokens are checked by openvibe-sdk/auth verifyServiceToken (the key their kid names), the outbox is createServiceOutbox; server/auth/sso.js and server/events/outbox.js are deleted. Pins: openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026 f3fac6a
The perf-budget test boots its server on its own PGlite directory (BLOG_PGLITE_DIR, a temp dir removed afterwards) with DATABASE_URL cleared: it used to fall back to the shared dev database data/pglite and migrate it. It also asserts the isolated directory was used. Found by the estate-wide floating-promise sweep (test isolation lost in the PostgreSQL move); reviewed independently (VERDICT: SHIP). npm test 25/25 test files passed.OpenVibers · 29 Sept 2026 ae80018
The rest of the SQLite-era cleanup (the previous commit carried only its deletions): *_DB_PATH/dbPath out of config, .env.example, the systemd unit and test helpers; the unused better-sqlite3 dependency and its lockfile entries; docs, docstrings and STATUS lines that still described SQLite or its rollback window. Reviewed independently (VERDICT: SHIP). npm test 25/25 test files passed.OpenVibers · 29 Sept 2026 32773c6
The SQLite era is gone (Blog has run on PostgreSQL since 2026-09-28 and keeps no compatibility): the one-time migrate-to-postgres script, BLOG_DB_PATH/dbPath (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency, and every doc, docstring and STATUS line that still described SQLite or its rollback window. npm test 25/25 test files passed.OpenVibers · 29 Sept 2026 1f8fc31
Await what the transactions start (PostgreSQL pass follow-up): the dashboard and list mappers now await postDto explicitly (behaviour unchanged: Promise.all already waited). A sync callback that calls async code returns before the work is done, so writes could land outside or after their transaction. npm test 25/25.OpenVibers · 29 Sept 2026 e37c8c2
openvibe-shared v1.29.2 (from its earlier pin): navbar dropdowns are no longer clipped by the links row, changing the theme repaints the page background, bright accents get dark button text (WCAG), the navbar brand is more compact. npm test: 25/25 test files passedOpenVibers · 29 Sept 2026 01f8c05
openvibe-shared v1.28.1 (from its earlier pin): the account panel keeps its sections' height on phones, the codes mark at rest shows its V, no empty space under the footer on phones. npm test: 25/25 test files passedOpenVibers · 29 Sept 2026 8167e40
openvibe-shared v1.27.0 (from v1.25.0): an async route handler's rejection now reaches the error handler instead of ending the process. Express 4 leaves such a promise unhandled and Node 22 exits on it; instrument() now applies openvibe-shared/express-async. 1.26.0 adds async gauge collects. npm test: 25/25 test files passed.OpenVibers · 28 Sept 2026 f145325
Blog moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G1), async from end to end.OpenVibers · 28 Sept 2026 8c8259f
WIP postgres: db, outbox, config, migrationOpenVibers · 28 Sept 2026 6df97e6
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 25/25.OpenVibers · 28 Sept 2026 9f339e3
README and STATUS.json are current (roadmap WS-U task 3): Capabilities is now a level-2 section and lists the grants Blog uses elsewhere, including network.integration.github.read (changelog) and ai.run.create/ai.run.read (AI drafts), which the grants list lacked; Deploy says production deploys with sudo ovhost deploy blog (unit, port, env file, vhost, rollback) and keeps the first-install steps; Security points to SECURITY.md; Depends on names the current pins (publishing v0.4.0, contracts v0.53.0, shared v1.22.0, sdk v0.12.0); the status line no longer says nothing is published (Patch notes posts are). STATUS.json gains contracts and features, drops the stale VIP and one-post claims, and is updated 2026-09-28.OpenVibers · 28 Sept 2026 8a7f8eb
Per-actor rate limits on Blog's /api/v1, the editor and comment posts (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app and counts requests once req.viewer is resolved. A person counts as user:usr_…, whether they use their own token or cookie, a service names them in X-OV-Subject, or an app acts for them through on_behalf_of. A first-party service relaying a signed-out visitor counts by the address it forwards. A service or app acting as itself counts by its principal. A signed-out caller counts by address. A first-party service reading for itself is not counted on reads. Neither is GET /api/v1/changelog: OpenVibe.Network reads it for every site's "shipped" widget from loopback without a token, so counting it would treat the whole network as one caller (Network caches each answer for 60 s, and the per-address limit still applies). Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work, including before the body is read, logs one [Limits] line and counts blog_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 21d537c

More commits