Commits
-
Add modular model plans for coding tasks (#410)OpenVibers · 2 days ago
8f95c63 -
Route hosted CLI calls through Exchange (#397)OpenVibers · 2 days ago
05d6af4 -
DeepSeek through OpenVibe.Exchange's compatible API (#384)OpenVibers · 3 days ago
606d903 -
AL1: a goal task is not ready until its check and an independent verifier accept (#376)OpenVibers · 3 days ago
7800364 -
A ticket follows its pull request (AL5) (#375)OpenVibers · 3 days ago
0e6fd9c -
Chat plays: the sandbox worker a viewer's request runs in (bubblewrap, egress proxy on a socket, cgroup limits, Wipe now) (#295)OpenVibers · 6 days ago
6c33655 -
D11 owner settings: codes.ai (#274)OpenVibers · 8 days ago
735ed08 -
Codes C9a: limits, the turn-cap reason, one continuation, Know (#183)OpenVibers · 14 days ago
bdb1c0c -
Codes is the open coding-agent harness; the developer console moved to OpenVibe.Services (#25)OpenVibers · 8 Oct 2026
c50db79 -
Events moves to openvibe.events: connect-src, stream URLs and shared 2.13.0 / sdk 0.35.0 in one change (plan T7) (#22)OpenVibers · 7 Oct 2026
b59cb4f -
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently; its blockers (an edited applied migration, the lockfile) are resolved here, Host's inventory follow-up is separate. npm test 28/28 test files passed.OpenVibers · 29 Sept 2026
c265b2a -
Codes moves to PostgreSQL and Valkey (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026
6329b53 -
Per-actor rate limits at Codes' capability boundaries (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits). server/http/actor-limits.js makes one limiter per app. It covers /api/v1, the signed-in portal (/projects), release actions, the developer tools' forms and the staff trust form. An app token counts as its app (app:app_…, the principal requireCapability verified), a signed-in person as user:usr_…, anyone else by address. Codes hosts no git remotes, so there are no clone or push routes to leave out. Past a limit a route answers 429 problem+json rate_limited with Retry-After before any work (before a form or upload is read and before Network is asked), logs one [Limits] line and counts codes_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026
d78de70 -
Project export, the full archive (roadmap WS-N task 9): a project's owner or an admin downloads one zip (POST /projects/:project/export/archive) with manifest.json (counts, limits reached, every file's size and SHA-256, what is not included), README.txt, project.json (the metadata document with the audit log: the configuration), modules/<release>.json (each release's app or mod manifest as validated), and per environment media/<env>/namespaces.json, media/<env>/objects.jsonl (every object, deleted ones too, with its public URL or a 1-hour signed one; objects are listed, not copied) and events/<env>.jsonl (the project's retained app.<project_key>.* events, paged). Media and Events are read only with Network's read-only export tokens (one per service and environment, asked again before they expire, never stored or logged; Network checks the role and audits each). A failing service fails the whole export and the page names the service, part and environment; a limit (CODES_EXPORT_MAX_OBJECTS 5000, CODES_EXPORT_MAX_EVENTS 10000 per environment) makes the part and the archive say complete: false and where they stopped. /docs/export describes the format. test/project-archive.test.jsOpenVibers · 26 Sept 2026
0ef363f -
.env.example: names with a working default are commented (optional), so ovhost validate's from-example check requires only what the service cannot run withoutOpenVibers · 26 Sept 2026
237d9ff -
Staff powers from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0, docs regenerate from it): Codes staff are staff.site.configure (admin, as before) or CODES_STAFF_SUBJECTS (break-glass), not a role comparison. test/staff-map.test.js fails on raw role checks (project roles and display reads allowed by name)OpenVibers · 24 Sept 2026
57809ad -
Session cookie accepts only Network session tokens (audience openvibe.network, not FedCM/app tokens)OpenVibers · 23 Sept 2026
76b1234 -
README (purpose, owns, does not own, depends on, grants, deploy, acceptance, launch rule, threat notes), STATUS alpha W20, .env.example, deploy (systemd unit, nginx vhost on 4900), CI on Node 22.22.1 (contracts check continue-on-error until release), capability, service manifest and codes.app-manifest@1 proposalsOpenVibers · 23 Sept 2026
958890d