Commits
-
openvibe-shared v2.20.0 (was v2.17.0) (#32)OpenVibers · 9 Oct 2026
fc4c049 -
openvibe-contracts v0.122.1 (was v0.113.0) (#31)OpenVibers · 9 Oct 2026
67c6cec -
openvibe-shared v2.17.0 (was v2.15.0) (#30)OpenVibers · 9 Oct 2026
8fc5aa7 -
openvibe-shared v2.15.0 (was v2.14.0) (#29)OpenVibers · 8 Oct 2026
00709ec -
openvibe-shared v2.14.0 (was v2.13.3) (#27)OpenVibers · 8 Oct 2026
58a8595 -
openvibe-codes 0.2.0: the harness runs coding tasks on any agent from your machine, with hand-offs between them. (#26)OpenVibers · 8 Oct 2026
a1b36d3 -
Codes is the open coding-agent harness; the developer console moved to OpenVibe.Services (#25)OpenVibers · 8 Oct 2026
c50db79 -
openvibe-shared v2.13.2 (was v2.13.0) (#24)OpenVibers · 8 Oct 2026
f83618f -
openvibe-contracts v0.112.0 (was v0.107.0) (#23)OpenVibers · 7 Oct 2026
514c164 -
Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#22)OpenVibers · 7 Oct 2026
b59cb4f -
openvibe-shared 2.12.0: the showcase home and the Frame footer set their font (they rendered serif) (#21)OpenVibers · 7 Oct 2026
96f27b9 -
Codes: the resource index (GET /api/v1/resources, codes.manifest/release) under codes.resource.read; contracts v0.107.0 (T13 step 8). (#20)OpenVibers · 7 Oct 2026
1d362fe -
Pin openvibe-shared v2.9.0 (from v2.6.0): showcase ring icons fill their slot (#15)OpenVibers · 5 Oct 2026
a90da2e -
Add Codes' /llms-full.txt (#14)OpenVibers · 5 Oct 2026
49c7fc7 -
Add the opencode harness to the registry and update its tests (#13)OpenVibers · 5 Oct 2026
a0219da -
Render every Codes page through openvibe-shared/shell v2.6.0OpenVibers · 4 Oct 2026
cd29b7e -
Bump openvibe-shared v2.4.0 → v2.5.0 (#10)OpenVibers · 3 Oct 2026
f3662e6 -
Publish harness offers as Fabric resource offers of kind harness (#9)OpenVibers · 3 Oct 2026
b612319 -
Pin openvibe-contracts v0.84.0, sdk v0.26.0 and shared v2.4.0OpenVibers · 2 Oct 2026
6bb0e80 -
Codes tells search engines when a page changes (plan T11, IndexNow): with INDEXNOW_KEY set the key file is served at /<key>.txt and a release or app page appearing, changing or going away pings the engines (its path and the sitemap); drafts and private pages never; unset, nothing is mounted or sent. A home-page performance budget runs in CI. Tests green (verified).OpenVibers · 29 Sept 2026
98bb8f9 -
Codes moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition, prefetching on intent, and does a normal load across a deploy (the ov-boost marker carries the release). The navbar's sign-in returns to the current page. test/layout.test.js pins the marker, the boost tag and the login template.OpenVibers · 29 Sept 2026
feb3d8b -
Codes' outbox is openvibe-sdk/events createServiceOutbox (plan T1): the same event_outbox table, event-type allowlist and relay rules in one call, the hand-rolled wrapper gone. Pins openvibe-sdk v0.25.0, openvibe-contracts v0.79.0, openvibe-shared v2.0.0. Both suites green (verified).OpenVibers · 29 Sept 2026
3408517 -
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently; its blockers (an edited applied migration, the lockfile) are resolved here, Host's inventory follow-up is separate. npm test 28/28 test files passed.OpenVibers · 29 Sept 2026
c265b2a -
Codes moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026
6329b53 -
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner through run() (same files, one at a time as before, 60 s timeout per file, VERBOSE=1 still prints every file's output): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs; README and STATUS.json follow). npm test (Node 22) 29/29.OpenVibers · 28 Sept 2026
1246445 -
The webhook tester checks signature v2 only (compatibility shim C-61). OpenVibe.Events stopped sending the v1 header (X-OpenVibe-Signature, an HMAC of the body alone that verifies forever) on 2026-09-28 (shim C-60) and every consumer requires v2, so /tools/webhooks no longer takes or shows v1 "for reference". webhooks.inspect() drops checkV1 and the signature input and returns { accepted, v2, bodyBytes, parsed } (or { accepted: false, reason } for unusable input); a delivery with only a v1 value is refused as having no X-OpenVibe-Signature-V2. The page lists only X-OpenVibe-Timestamp and X-OpenVibe-Signature-V2, keeps why v2 (it covers the time; ±300 s replay window), says v1 is retired, and has no v1 field or result block; verifyResult keys on reason or a missing v2 instead of v1. The in-browser check (public/js/webhook.js) computes and reads no v1; its v2 logic is unchanged. openvibe-sdk is pinned at v0.13.0, whose signDeliveryHeaders is v2 only, so generated samples and their curl replay carry no X-OpenVibe-Signature. README and STATUS.json describe the tester as v2 only and name sdk v0.13.0. Tests: the v1 cases are gone; new checks that inspect() has no v1 in its result, that a v1-only request is refused for want of v2 (also by the SDK receiver), that samples carry no X-OpenVibe-Signature, that the page has no v1 input, and that the browser script reads no v1 field; the secrets and SSRF probes post the v2 field. npm test (Node 22) 29/29.OpenVibers · 28 Sept 2026
64d8feb -
README and STATUS.json are current (roadmap WS-U task 3): the grants section opens with the two capabilities Codes implements and every grant it uses elsewhere (its principal, the person's token, the app's token, Network export tokens); the threat notes are now a Security section that points to SECURITY.md; Deploy says production deploys with sudo ovhost deploy codes (unit, port, env file, state, vhost, rollback and its one blocker) and keeps the first-install steps; Depends on names the current pins (contracts v0.53.0, sdk v0.12.0, shared v1.22.0). STATUS.json gains contracts and features, lists the per-project usage page (no longer under notYet), drops a stale release sha and is updated 2026-09-28.OpenVibers · 28 Sept 2026
7d6f65a -
Per-actor rate limits at Codes' capability boundaries (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app. It covers /api/v1, the signed-in portal (/projects), release actions, the developer tools' forms and the staff trust form. An app token counts as its app (app:app_…, the principal requireCapability verified), a signed-in person as user:usr_…, anyone else by address. Codes hosts no git remotes, so there are no clone or push routes to leave out. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work (before a form or upload is read and before Network is asked), logs one [Limits] line and counts codes_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026
d78de70 -
Per-project usage page (roadmap WS-N task 4): /projects/:project/usage?days=7|30|90&env=all|production|sandbox, for the project's owner, admins and staff, renders OpenVibe.Network's GET /api/v1/projects/:project/usage (network.project-usage-result@1, read with the person's own Network token like every project read): usage per service and capability (cards) and per day with the job type or tool, each recorded quota's use in its current window with a <meter> for headroom (or why a minute or hour window cannot be shown), the published limits of the services the project used (their /limits.json, through the reader /docs/limits now shares: server/domain/limits.js), errors by code, and the last sampled failures with their trace ids and job or event ids. Server-rendered and complete without JavaScript (the range is a GET form); developers and viewers get 403 without Network being asked; a Network failure shows as it answered. The project page links to it and no longer says usage is not collected; /docs/limits points to it. test/project-usage.test.js (mock Network serves /usage and records query strings)OpenVibers · 26 Sept 2026
253c29d -
Project export, the full archive (roadmap WS-N task 9): a project's owner or an admin downloads one zip (POST /projects/:project/export/archive) with manifest.json (counts, limits reached, every file's size and SHA-256, what is not included), README.txt, project.json (the metadata document with the audit log: the configuration), modules/<release>.json (each release's app or mod manifest as validated), and per environment media/<env>/namespaces.json, media/<env>/objects.jsonl (every object, deleted ones too, with its public URL or a 1-hour signed one; objects are listed, not copied) and events/<env>.jsonl (the project's retained app.<project_key>.* events, paged). Media and Events are read only with Network's read-only export tokens (one per service and environment, asked again before they expire, never stored or logged; Network checks the role and audits each). A failing service fails the whole export and the page names the service, part and environment; a limit (CODES_EXPORT_MAX_OBJECTS 5000, CODES_EXPORT_MAX_EVENTS 10000 per environment) makes the part and the archive say complete: false and where they stopped. /docs/export describes the format. test/project-archive.test.jsOpenVibers · 26 Sept 2026
0ef363f