Commits

main

Bump openvibe-shared v2.2.0 → v2.5.0 (#5)OpenVibers · 3 Oct 2026 9e40ad9
Move Search's shutdown onto openvibe-sdk/service gracefulStop (#4)OpenVibers · 2 Oct 2026 4d6e48c
Serve Search cache headers through openvibe-shared/cache-policy (#3)OpenVibers · 2 Oct 2026 e304199
Merge pull request #2 from OpenVibers/agent/search-t0-add-a-diagnostic-log-193718-mupxree7OpenVibers · 2 Oct 2026 78e82f8
Added a fixed JWKS failure warning in server/auth.js. It leaves the…OpenVibers · 1 Oct 2026 9985057
Search moves between its pages without a reload (plan T11): openvibe-shared v2.2.0 boost swaps <main> styles-first with the shared transition and does a normal load across a deploy (the ov-boost marker carries the release); page scripts that wire <main> also run on ov:boost:load. Tests pin the marker and the boost tag (verified).OpenVibers · 29 Sept 2026 eea0abe
Crawl files through openvibe-shared/seo (plan T11): /llms.txt (what Search is, its public pages and machine-readable endpoints), /robots.txt from the shared builder with every existing rule kept, /sitemap.xml whose lastmods come from the newest public document and the deployed release (never the clock), and WebSite JSON-LD with a SearchAction on the home page. Public data only. nginx proxies the two new paths. test/discovery.test.js fetches each. npm test green (verified).OpenVibers · 29 Sept 2026 fb2eed3
Network tokens verify with keys from openvibe-sdk/auth's JWKS client (v0.23.1) in place of the hand-written key store: fresh keys, the last good ones through a Network outage, backoff, and a rotation honoured on an unknown kid. Service tokens keep every openvibe-contracts verifyServiceToken rule (the key a token names first, else each key until one is not a bad signature); browsers' user JWTs verify with the SDK's verifyUserToken (principals refused as users, as before). Nothing public names the internal JWKS URL or the fetch error: a write's 503 says 'signing key not loaded yet' and /api/ready's network_jwks (still optional) reports counts and times only. OV_NETWORK_PUBLIC_KEY is gone (unset in production). Tests: a stub JWKS, an outage with cached keys and a rotated kid, and a JWKS that never loads (degraded, no leak in /api/ready or the 503). npm test 14/14, test:pg green.OpenVibers · 29 Sept 2026 a3235a5
The SQLite era is gone (on PostgreSQL since 2026-09-28; no compatibility kept): the one-time migrate-to-postgres script, the *_DB_PATH settings (config, .env.example, systemd unit, test helpers), the unused better-sqlite3 dependency and its lockfile entries, and docs, docstrings and STATUS lines about SQLite or its rollback window. Reviewed independently before shipping. npm test 12/12 test files passed.OpenVibers · 29 Sept 2026 7be6c42
Await what the transactions start (PostgreSQL pass follow-up): the outbox and CDN-purge queues' mark() ran each row's async write inside a sync db.tx callback without awaiting it. A sync callback that calls async code returns before the work is done, so writes could land outside or after their transaction. npm test 12/12.OpenVibers · 29 Sept 2026 7c07b41
Document counts: the tombstone sum is cast to bigint. On PostgreSQL SUM of a bigint column is numeric, which openvibe-sdk/db returns as exact text, so /api/ready's details reported the count as a string. npm test 12/12.OpenVibers · 28 Sept 2026 e2474e2
Search moves to PostgreSQL (ADR-035, roadmap WS-X2, repository-pass group G2), with a PostgreSQL full-text engine.OpenVibers · 28 Sept 2026 fa45c65
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs). npm test (Node 22) 12/12.OpenVibers · 28 Sept 2026 04f9fd4
README and STATUS.json are current (roadmap WS-U task 3): the README gains Security (auth, private data, loopback-only routes, egress, secrets by name) and Deploy (sudo ovhost deploy search, unit, port, env file, data path, rollback) sections, with Public host now under Deploy. Capabilities lists search.query.run and what Search calls at Events with which grant, and names the v0.49.0 pin. The header and STATUS.json no longer say the vhost is uninstalled (the manifest records the public host since 2026-09-23); STATUS.json names openvibe-contracts v0.49.0, the three capabilities, per-actor limits and updated 2026-09-28.OpenVibers · 28 Sept 2026 e8511d8
Per-actor rate limits at Search's API routes (roadmap WS-R task 4): openvibe-sdk v0.12.0 is now a dependency, and server/actor-limits.js makes one limiter per app. Owner routes count the service principal (svc:wiki); query and saved-search routes count the person, from their own token or the X-OV-Subject a delegating service vouches for, and a signed-out caller by address. A first-party service querying for its signed-out visitors is not counted, since it speaks for all of them and one budget would refuse its whole site. withViewer resolves the viewer first, so the limit runs after authentication and before the handler. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one [limits] line and counts search_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 8ed7667
Search's palette follows the network theme: --bg, --fg, --muted and --line now derive from --bg-primary, --text-primary, --text-secondary and --border, which the Frame's theme loader sets on <html>, with the old light and dark values as defaults. Before this, the theme loader applied the dark default theme while the body stayed white, and the shared shipped.js widget (theme tokens) failed axe color-contrast on the home page (0c00ac0 mapped the other way and did not fix it).OpenVibers · 26 Sept 2026 78fe5cd
Search's palette also answers the network token names (--text-primary, --text-secondary, --bg-secondary, --border). The shared shipped.js widget on the home page read them, fell back to its dark defaults on Search's light page, and failed axe color-contrast (9 nodes); found by Host's new release UX check (ovhost browser-watch).OpenVibers · 26 Sept 2026 0c00ac0
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 b00aa4c
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 18e7c29
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 74755cb
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 f58f819
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 91d2068
The CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports. The network's privacy text already says Cloudflare may measure performance, and Live and Tools allow it; here the policy blocked it and every page view logged a CSP error. Test: page.test.jsOpenVibers · 26 Sept 2026 f69ca74
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 e90cb82
The front page and /updates carry a canonical URL on the configured origin (config.baseUrl, passed to pageRouter); result pages stay noindex without one. The browser check (Host scripts/browser-check.js, WS-Q task 3) found the indexable front page with no canonical. test/page.test.jsOpenVibers · 26 Sept 2026 99f1e76
Search page: the button uses the derived --accent-strong pair (4.5:1 in every theme; white on the accent was 3.67:1) — WS-T task 3OpenVibers · 25 Sept 2026 162a9f0
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0OpenVibers · 25 Sept 2026 b70f275
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 ff202c7
Pins: openvibe-contracts 0.33.0 → 0.42.0; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 f5b1f97
Search page: the app icon's link tags without the web-app manifest (this service serves none, and its CSP has no manifest-src)OpenVibers · 24 Sept 2026 bef5188

More commits