Commits

main

deploy/scripts/deploy.sh: deploys run through ovhost deploy games (OpenVibe.Host strategy pnpm-build; roadmap WS-N task 11). ovhost does the production procedure (pull, pnpm install --frozen-lockfile, pnpm build, restart openvibe-games) with git as the checkout owner instead of sudo git, restores the tracked dist-types/ a previous build rewrote before the pull, checks every workspace package's dependencies and that better-sqlite3 loads under the host's Node before the restart, polls /api/ready, and on failure restores, reinstalls and rebuilds (the build writes the served client) and restarts again. Players online are reported and reconnect (drain policy report); --wait-idle holds the restart until nobody plays. The wrapper passes --wait-idle, --restart, --force, --rollback and DRY_RUN=1 (ovhost plan games); it asks ovhost capabilities games first and falls back to deploy/scripts/deploy-legacy.sh, the procedure as it was run by hand (sudo git -c safe.directory pull, pnpm install --frozen-lockfile, pnpm build, sudo systemctl restart openvibe-games, then a readiness wait and the best-effort release notification), when ovhost is missing, too old or the host inventory does not deploy games with pnpm-build (OVHOST_LEGACY=1 forces it). apps/server/scripts/deployWrapper.test.ts. README.OpenVibers · 27 Sept 2026 e2d9a5d
Client: the first connect gives up after 10 s, and a refused or timed-out connect waits for the server and reloads, as a dropped connection already did (WS-P task 3 game-shard proof: an upgrade sent during a restart can wait with no answer, so a page opened in that 2 s gap stayed on "connecting…")OpenVibers · 26 Sept 2026 b207e78
The server's 404 page names the client's icon (<link rel="icon" type="image/svg+xml" href="/favicon.svg">, as the client pages do since 0f29769). Without it the browser asked for /favicon.ico, a second 404 and a console error on every not-found page (browser check on /__ovcheck-404, Host scripts/browser-check.js, WS-Q task 3). Test: apps/server/src/net/httpServer.test.tsOpenVibers · 26 Sept 2026 74d039d
Client pages name an icon: public/favicon.svg, the network's app icon in the Games colours (openvibe-shared/app-icon favicon({ site: 'games' })), linked from index, play and editor. Without it the browser asked for /favicon.ico, which answers 404: a console error on every visit, found by the browser check (Host scripts/browser-check.js, WS-Q task 3). Test: apps/client/src/pages/pageIcon.test.tsOpenVibers · 26 Sept 2026 0f29769
Legacy import: the 12 held users re-checked 2026-09-26 (still unreachable: no linked account, disabled password markers, SSO-only Live); the 200 rows stay a documented import-hold (WS-M task 8)OpenVibers · 26 Sept 2026 1b70b69
dist-types: the shutdown test's declarations (tsc --build output, as for every other test)OpenVibers · 26 Sept 2026 45fe3fa
Graceful stop (WS-P lifecycle follow-up): SIGTERM used to exit synchronously, cutting every WebSocket session and HTTP request in flight and never awaiting the outbox. Now, within 10 s (the unit allows 30): stop taking connections and WebSocket upgrades (503) while requests in flight carry on with Connection: close; stop the simulation, metrics and prune timers, the editor lock sweeper and the media mirror; announce the restart to every player, then close every game and editor socket with 1012 service restart (each game close saves that character and records games.player.left; clients reconnect on their own; a socket that does not finish the handshake in 3 s is terminated); save the world; let requests finish (5 s at most); await the mirror pass, the progress-summary writes and the outbox's last send; close world.db; exit 0 (exit 1 only past the deadline or on a failed stop). MediaMirror.stop() now resolves when its pass ends and schedules nothing after; ProgressSummaryWriter.settle(). test: apps/server/src/shutdown.test.ts spawns the server as systemd runs it (outbox on), SIGTERM with a player socket, an editor socket and an HTTP request open: both sockets get 1012, new connections are refused, the request is answered, the outbox is stopped, exit 0 well inside the deadlineOpenVibers · 26 Sept 2026 142d4ec
Home keeps its navigation when openvibe.network is down (WS-P task 5): a plain nav (home, Scraplandia, the network sites) shows until the shared navbar mounts, and the theme loader is deferred so a slow openvibe.network never holds the first paint (the inline colours cover it)OpenVibers · 26 Sept 2026 ef3b2cf
Readiness reports the players online (WS-P task 2): a non-required sessions check with detail.online, which OpenVibe.Host's protected probe reads before a restart disconnects themOpenVibers · 26 Sept 2026 e11dd65
Moderation audit (ADR-022, WS-D task 1): games.moderation.action from the outbox in the same transaction when staff revoke (mod.revoked, with the reason and the grants it ended), disable (mod.disabled) or put back a disabled (mod.enabled) mod someone else published, the publisher as owner_subject; installs, first enables, grant changes and the publisher acting on their own mod report nothing. Declared in the service manifest proposal. Pins: openvibe-contracts 0.49.0 → 0.53.0OpenVibers · 26 Sept 2026 28c621d
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 19108de
Footer: the Games and Account columns as the shared footer's { name, url } items (label/href rendered six empty links; found by an axe survey, WS-T task 3)OpenVibers · 25 Sept 2026 9901bed
CI on the shared test and security workflows (WS-Q task 1, OpenVibe.Shared 66b76f8): install, node --check, tests, contract and pin-drift checks from one definition; this repository's own steps kept as inputs and extra stepsOpenVibers · 25 Sept 2026 e27e161
Pins: openvibe-contracts 0.39.0 → 0.44.0 (apps/server; openvibe-sdk already 0.9.1); CI runs the pin-drift checkOpenVibers · 25 Sept 2026 4d91de9
games.progress.summary on Network (Contracts user module, WS-B task 9): when a signed-in character leaves, Games folds the session into the person's summary (best total skill level, playtime, last world; achievements never written: Scraplandia has none) as the owning service, read-modify-write with If-Match; guests have no record and Network being down only logsOpenVibers · 25 Sept 2026 091fdd6
Guest conversion (WS-B task 8): the character a browser played as a guest moves into the account that signs in on it, into the first free slot, once (remembered by a hash of the guest token, never the token); it happens at the character list and at join, and a full account keeps the guest character where it was. Tests for the repository and the guest-then-sign-in flowOpenVibers · 24 Sept 2026 e307eaa
Sign-out everywhere reaches Games (WS-B task 4, Contracts 0.39.0, SDK 0.9.1): POST /internal/events (GAMES_EVENTS_SECRET, signature v2, loopback only) applies network.user.token_valid_after into the SDK revocation store and closes the person's sessions opened with an older sign-in (reject signed_out, 4011); guests are never touched; the subscription is created at boot when the secret is set. Sessions keep their sign-in's iatOpenVibers · 24 Sept 2026 5c002f2
Legacy import re-checked 2026-09-24: the same 12 no-subject Live users (200 rows) are the standing import-hold; players.subject_id needs no backfill (ovn:1 moved, the rest are device guests and probes)OpenVibers · 24 Sept 2026 bfebe5c
Rank from the contracts staff map (WS-D, ADR-022; Contracts 0.38.0): owner from the is_owner claim, admin from staff.games.manage (map editor, noclip, mod administration), moderator from staff.moderation.chat, read from the token the Network just accepted; the account's fresh role wins after a role change. OWNER_USERNAME and role-name comparisons are gone; noclip uses canEditMap. networkAuth.test.ts fails on raw role checksOpenVibers · 24 Sept 2026 9cfbd11
The OpenVibe Frame on openvibe.games: public/chrome.js is frame.js (__ovgFrame, ovg-frame-hidden, ovg-frame-toggle); the portal shows what shipped (the network's shared shipped views) and the footer's Updates link opens the Games log on openvibe.networkOpenVibers · 24 Sept 2026 3fe7f7b
Prometheus text metrics (Track O): GET /metrics (loopback only) answers the snapshot as games_* gauges in Prometheus text when the scraper asks (Accept text/plain or OpenMetrics, or ?format=prometheus); JSON stays the defaultOpenVibers · 24 Sept 2026 c318513
dist-types for observability/release (tsc --build)OpenVibers · 24 Sept 2026 f4f3f40
Release manifest and private metrics (Track R D43, Track O): GET /release.json answers the deployed commit (RELEASE_SHA, else read from .git without a child process), openvibe-sdk/contracts versions and components in the shape every OpenVibe service serves; GET /metrics answers only direct loopback callers (it was public through the proxy: tick, sessions, entities). observability/release.ts + testOpenVibers · 24 Sept 2026 35a06a0
openvibe-contracts v0.34.3 (was v0.8.0) and openvibe-sdk v0.6.0 (was v0.2.2); CI runs openvibe-contracts-check for the serverOpenVibers · 24 Sept 2026 4e5bc50
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 7c4d6bf
Unknown paths answer 404 instead of the landing page: a path that was neither a route nor a file of the client build used to get the portal (openvibe.games) or the game (play.openvibe.games) with a 200, a soft 404 that search engines index and monitors read as up. It now gets a real 404 with Cache-Control: no-store. Browsers get a small self-contained HTML page (inline CSS, no scripts) that shows the requested path escaped and links to the host's entry points (apex: /, /play, /editor; play host: /, /editor and the portal). Anything under /api, and a client that asks for JSON, gets {"error":"not_found"}, the shape /auth/* already answers. A missing asset (any extension but .html, e.g. /favicon.ico, /robots.txt, a stale /assets/*.js) gets plain text. HEAD and POST get the same status. Real routes keep their status: / (portal on the apex, the game on the play host), /play (301 to / on the play host), /editor, the build's files including the hashed /assets, /map.json, /map-assets/<id>, the API (/api/characters, /api/map, /api/map-assets, /api/texture, /api/ready, /api/v1/platform, /api/v1/mods), /auth/*, /healthz and /metrics; /play/ and /editor/ now redirect to their canonical URL, and /game and /canvas (the URLs from when the game lived on OpenVibe.Live, which still links and 301s to them) redirect to /play and / (both to / on the play host) instead of becoming 404s. The client has no router of its own, so no page prefix accepts sub-paths. apps/server/src/net/httpServer.test.ts drives the real HTTP layer over a stand-in build on both hostsOpenVibers · 23 Sept 2026 84ee13e
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 7863fc6
Live legacy import (Wave 12 migration gate): every HoboQuest and canvas table in Live has a recorded decision, and scripts/importLiveLegacy.ts reconciles each one (read = imported + held + excluded). Per-player HoboQuest rows (players, inventory, bank, achievements, recipes, fish, battle stats, structures, farm plots) are archived verbatim under the owner's Network subject in world.db legacy_live_rows (schema 13), because Scraplandia has no equivalent for them. Nothing is mapped into characters. Excluded: the world seed, expired daily quests, empty buff/dungeon/leaderboard tables, the pixel canvas (not a Games feature, and its rows carry IP addresses), and 47 placeholder game_players rows that Live's profile lookup still inserts. Subjects come from the Network identity service (system live) as the games principal, with Live's linked_accounts as a cross-check. Unresolved or conflicting owners are held and listed, never guessed. The importer is a dry run by default and idempotent (keyed by source primary key, never overwrites). --apply needs --backup, which it writes and verifies with integrity_check before one transaction. It refuses Live's production file. The dry run on production copies: 2224 read = 616 imported + 200 held + 1408 excluded. Not applied. docs/legacy-import.md has the inventory, the output and the host commandsOpenVibers · 23 Sept 2026 474df50
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 8aef490
GET /api/ready: 200 only while world.db answers and the simulation ticksOpenVibers · 23 Sept 2026 f11e21c

More commits