AGENTS.md: public AI text passes db.noLooks / noLooksTags / hasLooks (prompts alone miss about one in ten) (#205)

OP OpenVibers committed 27 days ago · 138dc0aca4 · 1 file, +1 −0

Changes

ddiff --git a/AGENTS.md b/AGENTS.md
iindex d81fd8df..9e32bf00 100644
---- a/AGENTS.md
++++ b/AGENTS.md
@@@ -57,6 +57,7 @@ Each feature lives in its own `server/<feature>/` directory with `routes.js` + s
  - **Inline handlers on lazy features:** a function called from `onclick=` in markup that exists before its feature loads must be listed in that feature's `stubs`.
  - **New page routes:** the SPA fallback answers 404 for any path [server/web/page-status.js](server/web/page-status.js) does not know. A new top-level route goes in both `routeFromURL()` and that file's page list.
  - **innerHTML usage:** Frontend has heavy `innerHTML` — prefer DOM node creation for new code to avoid XSS.
++- **Public AI text never describes people:** no looks, body, clothing, hair, age or guessed gender (owner's rule). Prompts say so, but models ignore it about one time in ten. So AI text that is stored or served publicly passes `db.noLooks()` (and `db.noLooksTags()` for tags), and a short AI title naming looks is replaced (`db.hasLooks()`, `publicTitle` in `server/ai/ai-moments-job.js`). New writers do the same. `test/ai-text-no-looks.test.js` holds the cases.
  - **WebSocket auth lifecycle:** WS connections can start anonymous and upgrade via `join` message. On account switch, the socket must be rebuilt (not just re-joined) — see `openvibe-auth-changed` handling in `chat.js`.
  - **openvibe-shared:** Pinned release of OpenVibers/OpenVibe.Shared (`"openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/vX.Y.Z"`), served at `/shared/*` from `node_modules`. Change it there and bump the tag; never edit `node_modules`.
  - **DM delivery:** Server verifies `dm.isParticipant()` before delivering — always maintain this check.

diff --git a/AGENTS.md b/AGENTS.md

index d81fd8df..9e32bf00 100644

--- a/AGENTS.md

+++ b/AGENTS.md

@@ -57,6 +57,7 @@ Each feature lives in its own `server/<feature>/` directory with `routes.js` + s

- **Inline handlers on lazy features:** a function called from `onclick=` in markup that exists before its feature loads must be listed in that feature's `stubs`.

- **New page routes:** the SPA fallback answers 404 for any path [server/web/page-status.js](server/web/page-status.js) does not know. A new top-level route goes in both `routeFromURL()` and that file's page list.

- **innerHTML usage:** Frontend has heavy `innerHTML` — prefer DOM node creation for new code to avoid XSS.

+- **Public AI text never describes people:** no looks, body, clothing, hair, age or guessed gender (owner's rule). Prompts say so, but models ignore it about one time in ten. So AI text that is stored or served publicly passes `db.noLooks()` (and `db.noLooksTags()` for tags), and a short AI title naming looks is replaced (`db.hasLooks()`, `publicTitle` in `server/ai/ai-moments-job.js`). New writers do the same. `test/ai-text-no-looks.test.js` holds the cases.

- **WebSocket auth lifecycle:** WS connections can start anonymous and upgrade via `join` message. On account switch, the socket must be rebuilt (not just re-joined) — see `openvibe-auth-changed` handling in `chat.js`.

- **openvibe-shared:** Pinned release of OpenVibers/OpenVibe.Shared (`"openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/vX.Y.Z"`), served at `/shared/*` from `node_modules`. Change it there and bump the tag; never edit `node_modules`.

- **DM delivery:** Server verifies `dm.isParticipant()` before delivering — always maintain this check.