Commits

main

The chat-AI summaries run in Chat (plan T3 step 2): Live's job ported over Chat's own messages and projections (same cadence, selection, prompts, fields and limits), calling OpenVibe.AI with Chat's own token (workflows chat.global/chat.profile, namespace chat), with an extractive fallback when AI is unavailable, writing Chat's tables under the authority rule; /api/chat/ai/{global,timeline,user/:id,anon/:anonId,relay/:platform/:username,timeline/:username} with Live's shapes. Off until CHAT_AI_ENABLED (set at the cutover, when Live's job stops). test/chat-ai.test.js; 43/43 (verified).OpenVibers · 29 Sept 2026 adb2ab3
Chat serves the features built on the six chat tables (plan T3 step 1): Live's read API GET /internal/moderation/channels/:id, /users/:id/channels and /channels/:id/emote-count (chat.moderation.read, loopback, service token; answers validate against Contracts 0.80.0); the emote API at /api/emotes with Live's paths, shapes, limits and messages, bytes to Media with Chat's own token (the declared type must match the bytes); channel moderators and moderation settings under /api/chat/channels/:id; the playAlertSound bridge op resolving the sound from Chat's own settings row. Writes refuse with 503 until the tables' authority flips. test/chat-apis.test.js (13 checks); 42/42.OpenVibers · 29 Sept 2026 0e38083
robots.txt, llms.txt and sitemap.xml come from openvibe-shared/seo (plan T11, server/web/discovery.js): public data only, lastmod from the data itself (the newest public message, each room's last activity), never today; every previous Disallow kept. The home page carries WebSite + WebApplication + WebPage JSON-LD. test/discovery.test.js covers the artifacts. audio-queue's restart case now waits for all three durable rows before reading them (the announce comes before the insert, the race the last verify hit).OpenVibers · 29 Sept 2026 2091ec6
Pins current (plan T3 step 0): openvibe-sdk v0.23.1 (openvibe-sdk/db, ambient transactions, openvibe-sdk/testing, the JWKS client), openvibe-contracts v0.79.0, openvibe-shared v2.0.0 (none of its removed exports were used here), and the PostgreSQL/Valkey drivers pg, @electric-sql/pglite and iovalkey at Media's versions for the move that follows. No source change was needed. npm test 40/40.OpenVibers · 29 Sept 2026 50e4dc1
openvibe-shared v1.29.2 (from v1.25.0): navbar dropdowns no longer clipped, themes repaint the canvas with readable button text, compact brand, async gauge collect (1.26), async Express handler errors reach the error handler (1.27). message-deleted's end-to-end half runs against today's OpenVibe.Events on PostgreSQL: Events gets a migrated database from its own test/db.js (PGlite, or the containers), and the store's lastSeq/scan/getEvent are awaited (they were read as values, so the replay asked from NaN and timed out). npm test 40/40.OpenVibers · 29 Sept 2026 eab0c20
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so message-deleted without an OpenVibe.Events checkout next to it, which then skips its end-to-end tests, read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. message-deleted printed "(no OpenVibe.Events with redaction at …: the end-to-end tests are skipped)" and now prints "message-deleted end-to-end: skipped (no OpenVibe.Events with redaction at …)", so a run without the Events checkout (CI) reads 39/40 test files passed, 1 skipped. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs). npm test (Node 22, Events checkout present) 40/40; audio-queue's restart case failed once in five runs under load (it expects three !long rows while the first 2 s clip plays), a timing race in that test that nothing here touches.OpenVibers · 28 Sept 2026 4c517a5
README and STATUS.json are current (roadmap WS-U task 3): the README gains Security (SECURITY.md, auth, private data, network exposure, egress, secrets by name) and Deploy (sudo ovhost deploy chat, unit, port, env file, /ready, both nginx files, N-1 recording, rollback) sections. Capabilities and events now lists every event Chat produces and consumes and the grants it uses at Live, Events, Network, VIP and Tools. The status, domain and launch-rule lines say openvibe.chat launched on 2026-09-24 (it left OpenVibe.Sites that day), not that it is a placeholder, and drop a stale release sha. STATUS.json names openvibe-contracts v0.71.0, gains features, corrects the domain, events, capabilities used and the in-code-only notes, and is updated 2026-09-28.OpenVibers · 28 Sept 2026 d87c8d3
Signed-out reads keep only the per-address limit (900 a minute). On Live's busiest streams many viewers share one carrier or campus address, and a per-actor budget of 120 a minute for all of them would refuse real people. Signed-in reads, bots and every write keep their per-actor numbers. test/actor-limits.test.js: eight signed-out reads from one address all pass, and no chat.read refusal is counted. npm test passes.OpenVibers · 28 Sept 2026 3aab730
Per-actor rate limits on Chat's REST API (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/net/actor-limits.js is one limiter for the app. It counts a person as user:usr_… (user:<id> before their subject is known) whether they call with their Network token or an hbt_ API token, so a bot counts against its owner, and anyone else by their own address. The caller's token is resolved once per request (auth.js requestUser, now shared by requireAuth, optionalAuth and the ban exemption), so reads count against the person rather than the address. Browsers call these routes themselves; Live's service calls (the bridge at /internal/live and the stream hooks at /internal/calls) carry every viewer's chat, so they are never limited and never count as svc:live. The WebSocket keeps its own flood control. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work, logs one [Limits] line and counts chat_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 27cb1cb
N-1 fixtures re-recorded from a2d100d, the Chat release now in production, with Live's widget at 06cf38b (npm run n-1:record).OpenVibers · 27 Sept 2026 ccc5349
Chat takes part in account export and deletion (roadmap WS-B task 7, ADR-033; openvibe-contracts 0.57.0 -> 0.71.0). POST /internal/events takes network.account.export_requested and network.account.deleted (subscribed at boot). server/chat/account-data.js applies each once per export or deletion (account_data_events) and answers after Network took the part or confirmation, so a failure is redelivered without erasing twice.OpenVibers · 27 Sept 2026 a2d100d
N-1 fixtures re-recorded from the Chat release now in production, with Live's widget at efab014 (npm run n-1:record).OpenVibers · 27 Sept 2026 561cec9
Chat follows account merges (roadmap WS-B task 5, ADR-029). network.subject.merged joins the consumer's topics (a sixth subscription at boot) and server/chat/subject-merge.js applies it inside the inbox, once per event, in one transaction. The folded-in account's chat messages (author by subject and by Live user id, and the channel it posted in), room and DM messages, DM conversations it started, rooms it owns, attachments and calls become the survivor's. DM participants and room members move, except where the survivor is already in; that row stays and the other goes. DM blocks and the platform-block projection move with the survivor's pair winning, and blocking oneself goes. Moderation actions and AI summaries stay as recorded. test/subject-merge.test.js: messages and channels, DM messages, a DM and a group both are in, blocks, moderation history untouched, a redelivery, and another source or a bad payload ignored; events-consumer.test expects the sixth subscription. npm test 38/38.OpenVibers · 27 Sept 2026 88202c1
N-1 fixtures re-recorded with Live's widget at f0edbc0, the Live release now in production (N1_LIVE_REF=f0edbc0 npm run n-1:record).OpenVibers · 27 Sept 2026 b3252cb
N-1 fixtures re-recorded from d4704b2, the release now in production (npm run n-1:record).OpenVibers · 27 Sept 2026 4c563fc
The soundboard's audio download cannot be steered inward (roadmap WS-R task 5: SSRF; low). The audio URL comes from 101soundboards' API answer; its check allowed only 101soundboards.com but judged one DNS answer with its own list, which missed ::ffff:127.0.0.1 and the other IPv6 spellings of internal addresses and CGNAT, and the download resolved the name again (a rebinding name got a second answer). Every answer must now be public by openvibe-shared/egress's rule, and the download connects through its safeLookup.OpenVibers · 26 Sept 2026 d4704b2
Detaching a room says nothing to someone who may not (roadmap WS-R task 5: IDOR; low). A member who is not the room's manager got { removed: false } for an attachment that does not exist and 403 for one that does, so they could tell where a room is attached, which only its owner may list. The refusal now comes first; the owner (and whoever attached it) still gets removed: false for a second detach.OpenVibers · 26 Sept 2026 9133c44
Secrets and private rooms, by crawl (roadmap WS-R task 5: internal-secret leak, private room bypass). test/security-crawl.js lists every route of the booted app from Express's router stack (a route added later is crawled without anyone listing it), fills parameters with seeded values and GETs each path as several people, with the session cookie and the bearer token; third-party fetches are kept off the network.OpenVibers · 26 Sept 2026 655135d
N-1: fixtures re-recorded from 6181238 with Live's chat surfaces at 13525eb, the releases in production. The Live-file filter now matches the checkout's own directory name (the harness labels files with it). From a checkout not named OpenVibe.Live, every Live call was kept, including ones nginx never sends to Chat, and the test failed on 112 Live-only routes.OpenVibers · 26 Sept 2026 ac1708a
The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 6181238
N-1 test: the booted release's stub data directory (test/helpers.js's temp directory) goes when it exits, so each run leaves nothing in the temp directoryOpenVibers · 26 Sept 2026 04bdd66
N-1 tests (roadmap WS-P task 11): the previous release's clients against this server, and its SQL against this schema. test/n-1.test.js boots this checkout with its own test/helpers.js (stub Network and Live) on a database created from the previous release's schema, so Chat's migrations run over it, and replays test/fixtures/n-1/client.json inside openvibe-shared's mixed-version matrix (release-compat assertMixedVersion): 104 requests (Live's chat widget, messenger and pickers at Live 8caa540 on the paths nginx sends to Chat, Chat's own pages' scripts, links and forms, the openvibe-sdk chat client; every call anonymously, reads signed in), each answered compatibly (status, JSON, every response field the client reads with a type it had), and two /ws/chat sessions (anonymous and signed in) sending the six message types Live's chat and Chat's page send (join, get-users, chat, join_room, room_message, self-delete-history): every reply type the client handles must still come, with the fields it reads. Then every statement in test/fixtures/n-1/worker.json (222: what that release ran, plus its SQL literals) must still prepare on the migrated schema, and no old INSERT may miss a new NOT NULL column without a default. Fixtures recorded from 739d3a1, the release in production; refresh after each deploy with `N1_LIVE_REF=<live sha> npm run n-1:record [ref]` (a temporary worktree of the release, booted, seeded, replayed; Live's files from N1_LIVE_REPO, default ../OpenVibe.Live). The harness is the file Live, Media and Community share (test/n-1/harness.js); test/n-1/service.js is Chat's part. In npm test, so in CI, about 6 s, no git history or network. Checked by breaking it: renaming users-list's users field fails it.OpenVibers · 26 Sept 2026 c4c80d8
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 739d3a1
Rooms: call and system kinds, the full role set, Community attachments; openvibe.chat: call rooms, the DM inbox, working with Live down (roadmap WS-I tasks 4 and 8)OpenVibers · 26 Sept 2026 66724bd
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 3cdd1dd
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 9b7da46
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 252ac09
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 df36e31
Parity gaps closed (roadmap WS-I task 6): sub-only mode, blocks in public chat, slow mode as the saved setting, purges and deletes on every surface, /clear says what it doesOpenVibers · 26 Sept 2026 bcc53f4
Chat parity script (roadmap WS-I task 6): scripts/parity.js runs the chat product end to end over the real protocol with two or three people connected and checks what each sees, one scenario per item: join (anonymous and signed in, the user list), send (echo and delivery with one id, history), DM (participants only, no echo, a non-participant refused), /tts (the room's tts line, the request in the channel's queue, the audio frame), soundboard (!sound: announce, audio, queue), ban, timeout, purge (the dashboard's ISO range), slow mode (viewers slowed, moderators exempt), the popout (a live popout and a channel-room popout, as popout-chat.html joins), and reconnect convergence (a reader away while a line is deleted and another written reads ?after_id= and ends with the connected reader's view; a fresh page agrees). Sub-only mode and blocks in public chat do not exist: those two scenarios report the gap and touch nothing. test/parity.test.js runs the same scenarios against Chat with stubs (found by npm test) and adds Live's moderator paths through the bridge (the context-menu ban that disconnects and drops the user from the list, the single-message delete converging in the global feed's cursor read), the DM participant rule on delivery, and the CLI: its dry run prints the plan and opens nothing, and --apply first resolves every account behind the tokens and the stream's owner and runs nothing unless all are named in OV_PARITY_TEST_ACCOUNTS. docs/parity.md: how to run it, the gaps, what was fixed on the way.OpenVibers · 26 Sept 2026 91a36f2

More commits