Commits

main

The notification bell hears new notifications as they happen (notificationsRealtime; Shared 1.22.0, roadmap WS-E task 3): Network's network.notification.created over OpenVibe.Events' realtime stream, with polling as the fallback. Only a signed-in bell with a Network token opens a stream.OpenVibers · 26 Sept 2026 d0dbc22
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 0bfdf70
Project export, the full archive (roadmap WS-N task 9): a project's owner or an admin downloads one zip (POST /projects/:project/export/archive) with manifest.json (counts, limits reached, every file's size and SHA-256, what is not included), README.txt, project.json (the metadata document with the audit log: the configuration), modules/<release>.json (each release's app or mod manifest as validated), and per environment media/<env>/namespaces.json, media/<env>/objects.jsonl (every object, deleted ones too, with its public URL or a 1-hour signed one; objects are listed, not copied) and events/<env>.jsonl (the project's retained app.<project_key>.* events, paged). Media and Events are read only with Network's read-only export tokens (one per service and environment, asked again before they expire, never stored or logged; Network checks the role and audits each). A failing service fails the whole export and the page names the service, part and environment; a limit (CODES_EXPORT_MAX_OBJECTS 5000, CODES_EXPORT_MAX_EVENTS 10000 per environment) makes the part and the archive say complete: false and where they stopped. /docs/export describes the format. test/project-archive.test.jsOpenVibers · 26 Sept 2026 0ef363f
Open redirect fixed (roadmap WS-R task 5): the sign-in next let "/<TAB>/evil.com" through, which browsers read as "//evil.com" (they drop tab and newline characters and read a backslash as "/"); any control character or backslash in next now goes home. test/open-redirect.test.js feeds it the known bypassesOpenVibers · 26 Sept 2026 341a18f
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 c090e28
Limits page: Media's /limits.json joins Host's and Events' (namespaces and quotas, WS-G task 2); an hours unitOpenVibers · 26 Sept 2026 bdd79c5
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 3e11696
Limits page: Host's section says it is read from Host's /limits.json instead of linking openvibe.host/limits.json, which the Sites placeholder answers 404 until Host Stage B serves openvibe.hostOpenVibers · 26 Sept 2026 8afc669
Limits and tiers page (roadmap WS-N task 7): /docs/limits states the policy (sandbox and production, enforced at the capability by its owner, 429/413 problems with retry hints, trust tiers never change the grant check, overrides are per project) and renders Host's and Events' /limits.json as they answer, cached 5 minutes; a service not answering shows its problem and no numbers; grantable capabilities whose owner publishes no limits are listed with their quota class. Linked from /docs and the sitemapOpenVibers · 26 Sept 2026 2985c64
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 900559b
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 a89ab3b
A guest's session probe answers 200, not 401 (browser check, WS-Q task 3): GET /auth/me with no codes_at or codes_rt cookie (and no Authorization header) answers { user: null }, which the shared navbar reads as signed out. It asks on every page view, and the 401 logged a console error on each. A session cookie that is present but does not resolve still answers 401. Test: security-session.test.jsOpenVibers · 26 Sept 2026 a2127a9
The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error.OpenVibers · 26 Sept 2026 0cb7804
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 0d8ac03
nginx: /auth/me, the session probe the shared navbar asks on every page view, gets its own location on the API zone (burst 30) instead of the sign-in zone (10 a minute, burst 10), and both answer 429 when limited instead of nginx's default 503. The browser check (Host scripts/browser-check.js, WS-Q task 3) saw /auth/me answer 503 after about ten quick page loads, which the navbar takes as signed out. test/nginx-auth-limit.test.js. Takes effect when the vhost is next installed (not deployed here)OpenVibers · 26 Sept 2026 f1ddee9
.env.example: names with a working default are commented (optional), so ovhost validate's from-example check requires only what the service cannot run withoutOpenVibers · 26 Sept 2026 237d9ff
Docs: /docs/billing renders the billing policy from OpenVibe.Billing's /policy.json (WS-K task 10): currencies, purchase tiers with the creator value and what OpenVibe keeps, tips, the subscription split and fee, cashout minimum and hold; cached 5 min, a problem (502) and no numbers when Billing does not answer; in the docs index and the sitemapOpenVibers · 26 Sept 2026 e86ba95
Moderation audit (ADR-022, WS-D task 1): codes.moderation.action from the outbox in the same transaction: release.revoked when Codes staff revoke a release their project role would not let them manage (also a staff project deletion), app.trust_changed for every trust tier set (from, to, the note as reason); a member revoking their own release reports nothing. Pins: openvibe-contracts 0.51.0 → 0.53.0OpenVibers · 26 Sept 2026 28dbf08
Docs: the update system (WS-A task 4) at /docs/updates: the network changelog feed and its shape (with a live sample), the data-ov-shipped markup, openvibe-shared/frame shipped()/updatesBody()/shippedScript() and openvibe-sdk/frame mountFrame, with the installed versions; linked from /docs and in the sitemapOpenVibers · 26 Sept 2026 fbe0ebe
API explorer (WS-C task 6): /docs/api lists every service's OpenAPI 3.1 document from openvibe-contracts 0.51.0; /docs/api/:service shows each route with its method, capabilities, visibility, parameters, request and response schemas (linked to their contract pages) and a public-only filter; /docs/api/:service.json serves the document with CORS *; capability pages link their routes; in the sitemapOpenVibers · 25 Sept 2026 eba81c5
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 de62855
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit); test/docs.test.js expects v0.44.0OpenVibers · 25 Sept 2026 bdb28de
Pins: openvibe-contracts 0.38.0 → 0.42.0, openvibe-sdk 0.5.0 → 0.9.1; test/docs.test.js expects the new pinned tags (it asserts the pinned versions on purpose); CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 5bfd3f9
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0, docs regenerate from it): Codes staff are staff.site.configure (admin, as before) or CODES_STAFF_SUBJECTS (break-glass), not a role comparison. test/staff-map.test.js fails on raw role checks (project roles and display reads allowed by name)OpenVibers · 24 Sept 2026 57809ad
The OpenVibe Frame from this site's own pinned copy: /shared/* is served by openvibe-shared/serve (1.12.0) and every page references it by content hash (/shared/<file>?v=<hash>), so this site's pin decides what its pages run and its navbar and footer keep working while openvibe.network is downOpenVibers · 24 Sept 2026 4dc695b
The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out (logoutUrl ends this site's session) and carries this site's account links in its menu, while the page's own account bar is only for no-JS visitorsOpenVibers · 24 Sept 2026 df5e0a4
CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those stepsOpenVibers · 24 Sept 2026 e82321b
Docs: /docs/tools lists every OpenVibe tool with an API from Tools' live registry (loopback, cached 5 min; how it runs, who may call it, JSON or files), with the run API, jobs, OpenAPI and SDK; linked from /docs and the sitemapOpenVibers · 24 Sept 2026 69fc5b1
Docs: /docs/events links each event's payload contract (117 published) and marks the rest planned, instead of saying payload schemas do not exist; openvibe-contracts v0.34.2; the per-address rate limit is CODES_RATE_LIMIT_PER_MIN (default 300), raised in tests that fetch every contract pageOpenVibers · 24 Sept 2026 a129415
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 587fb3f

More commits