Commits

main

Sources moves to PostgreSQL (ADR-035, roadmap WS-X2, repository-pass group G2), async from end to end.OpenVibers · 28 Sept 2026 6f68dd5
npm test no longer counts a skipped test as passed (roadmap WS-Q task 7; openvibe-shared/test-runner, Shared v1.25.0). test/run.js counted every file that exited 0 as passed, so a file that printed that it skipped its work and checked nothing still read as green. It is now the shared runner (same files, one at a time as before, 60 s timeout per file): a test prints "<label>: skipped (<why>)" for what it could not run, and that file is listed with ○ and its reasons and not counted as passed; --strict makes a skip fail the run. No test here skips anything. openvibe-shared is pinned at v1.25.0 (from v1.22.0; 1.23 and 1.24 add the web runtime, release-watch fixes and the readiness skip, and /api/ready answers as before because its db check really runs). npm test (Node 22) 11/11.OpenVibers · 28 Sept 2026 6e1185e
README and STATUS.json are current (roadmap WS-U task 3): the README gains Capabilities (the three implemented capabilities and the events.event.publish grant Sources uses at Events), Security (service-token auth, the SSRF-guarded fetcher, credentials by variable name, data rules) and Deploy (sudo ovhost deploy sources, unit, port, env file, data path, rollback) sections, with Public host now under Deploy. The pin is v0.49.0, not v0.33.0; the capability id in the processing-jobs table is sources.item.read; the header no longer claims the vhost is uninstalled. STATUS.json gains features and updated 2026-09-28.OpenVibers · 28 Sept 2026 1670853
Per-actor rate limits on Sources' /api/v1 (roadmap WS-R task 4; openvibe-sdk v0.12.0 is now a dependency). server/api/actor-limits.js counts each request by the principal that passed the route's capability guard (req.principal.sub: svc:news, app:app_…), before any work. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one [limits] line and counts sources_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026 351383e
A failed fetch's event no longer carries the endpoint's credential (roadmap WS-R task 5: internal-secret leak; low). sources.fetch.failed named the endpoint as registered, so a feed whose URL carries a provider key (?api_key=…) sent that key to OpenVibe.Events and every first-party subscriber's logs. Secret-looking query parameters (key, api_key, token, access_token, secret, signature, password, …) are now redacted in the event; the run records, readable only with sources.source.read, keep the endpoint as it is.OpenVibers · 26 Sept 2026 ad53d2f
The fetch guard's address rule cannot drift from the platform's (roadmap WS-R task 5: SSRF; low). Sources keeps its own address list, and it had drifted from openvibe-shared/egress (the rule Live, Events, Chat and Tools use): IPv4-compatible IPv6 (::127.0.0.1, ::7f00:1) and the local-use NAT64 prefix 64:ff9b:1::/48 counted as public. An address must now pass both.OpenVibers · 26 Sept 2026 8a7b7ea
Pins: openvibe-shared 1.20.0 -> 1.22.0 (realtime notification badge, off until a site turns it on; the unreachable-host browser check)OpenVibers · 26 Sept 2026 29cd386
README: processing jobs, who does what (roadmap WS-O task 7): dedupe within a source and the coarse category stay in Sources; cross-source dedupe, fine classification, summaries (through OpenVibe.AI's seeded workflows) and quality checks belong to each product; there is no AI <-> Sources client, the product is the only client of bothOpenVibers · 26 Sept 2026 9d88e57
Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 d423030
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 bb8e68f
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 32c8c98
Pins: openvibe-shared 1.16.0 -> 1.16.1 (the OV mark stops animating when idle, hidden or off-screen)OpenVibers · 26 Sept 2026 44c69cc
The public landing page's CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports; the page still runs no script of its own. The network's privacy text already says Cloudflare may measure performance; default-src 'none' blocked it and logged a CSP error. Test: public-host.test.jsOpenVibers · 26 Sept 2026 3abc2de
Pins: openvibe-shared 1.13.0 -> 1.16.0OpenVibers · 26 Sept 2026 375cf8f
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0OpenVibers · 25 Sept 2026 85fd578
Pins: openvibe-contracts 0.42.0 → 0.44.0 (Contracts 0.43.0 and 0.44.0 were released after the previous pin commit, leaving 0.42.0 two minors behind the pin-drift limit)OpenVibers · 25 Sept 2026 520e12c
Pins: openvibe-contracts 0.33.0 → 0.42.0, openvibe-shared 1.7.0 → 1.12.0; CI runs the pin-drift check (shared test and security workflows at 423fe51)OpenVibers · 25 Sept 2026 c6aa73a
One W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts onlyOpenVibers · 24 Sept 2026 ab2bd6a
CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 24 Sept 2026 d360451
SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 24 Sept 2026 cf00390
openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23 Sept 2026 a567d2e
openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0OpenVibers · 23 Sept 2026 1d591a1
W14: sources.openvibe.network answers an honest internal-service page, never the admin placeholderOpenVibers · 23 Sept 2026 2e986af
CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 23 Sept 2026 202aec4
Track O: /metrics for direct loopback callers and a truthful /api/ready (openvibe-shared v1.3.0)OpenVibers · 23 Sept 2026 072f529
Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 23 Sept 2026 887303e
nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose the address the service bans and rate-limits byOpenVibers · 23 Sept 2026 60a920d
openvibe-contracts v0.13.0 (manifest, capabilities and schemas released in v0.12.0); contracts check in CIOpenVibers · 23 Sept 2026 f727a40
Contracts proposals (sources.source@1, sources.item@1), capability and service manifest proposals, README, STATUS alpha W14, env example, systemd unit, nginx vhost, CI on Node 22.22.1OpenVibers · 23 Sept 2026 65b893b
Sources service: source registry, ingestion workers with robots.txt, rate limits, conditional GET, address guard and explicit fetch-run states; RSS/Atom, sitemap, JSON-LD, mapped-API and manual adapters; items with provenance and revisions; events through an outboxOpenVibers · 23 Sept 2026 94f0bc0

More commits