Commits
-
openvibe-shared v2.21.1 (was v2.21.0) (#37)OpenVibers · 10 Oct 2026
42e7ee5 -
openvibe-shared v2.21.0 (was v2.20.4) (#36)OpenVibers · 10 Oct 2026
b240583 -
openvibe-shared v2.20.4 (was v2.20.3) (#35)OpenVibers · 10 Oct 2026
4366b00 -
Tools: the migration era is deleted (SQLite migration scripts, legacy deploy path, SQLite readiness and reporting) (#33)OpenVibers · 10 Oct 2026
f8d87ae -
openvibe-shared v2.20.3 (was v2.20.0) (#31)OpenVibers · 10 Oct 2026
99c04c4 -
openvibe-shared v2.20.0 (was v2.17.0) (#27)OpenVibers · 9 Oct 2026
9483c4f -
openvibe-shared v2.17.0 (was v2.15.0) (#25)OpenVibers · 9 Oct 2026
ff5a1b7 -
openvibe-shared v2.15.0 (was v2.13.2) (#24)OpenVibers · 8 Oct 2026
d9cb9d5 -
Links: the developer console (projects, usage, the limits page) is on openvibe.services now. (#21)OpenVibers · 8 Oct 2026
f0d15ce -
openvibe-shared v2.13.2 (was v2.13.0) (#20)OpenVibers · 8 Oct 2026
5d33c39 -
Tools: every app pins openvibe-shared 2.13.0 and allows only openvibe.events (plan T7) (#17)OpenVibers · 7 Oct 2026
f7858b3 -
Tools: the legacy limiters are deleted (the guard enforces since 2026-10-07); TOOLS_GUARD defaults to enforce. (#15)OpenVibers · 7 Oct 2026
96383e3 -
Send Billing usage readings under the tools manifest idOpenVibers · 4 Oct 2026
38f0791 -
Stop the Billing readings tick when Network refuses a tokenOpenVibers · 4 Oct 2026
c8a0c1f -
Post one Billing usage reading per ended tool jobOpenVibers · 4 Oct 2026
c3c7cc5 -
Docs: close out the T8 PostgreSQL cutover (README + evidence + guard)OpenVibers · 4 Oct 2026
5a1f33e -
Tools job events: the event_outbox table is an owner migration, never runtime DDL (plan T8 review): outboxFromEnv no longer calls createPgOutbox.ensureSchema through the runtime role (DATABASE_URL may have no DDL rights); outbox.ready checks the table and names migrations/0004_event_outbox.sql when it is missing. job-events.test.js: no runtime DDL, the missing-table report. The migration file itself follows (its DDL mirrors the installed openvibe-sdk).OpenVibers · 29 Sept 2026
07676e8 -
README: the removed routes are documented as removed (plan T8 phase 6: /api/process*, /api/net/*, /api/dev/* and the /api/net/tools and /api/dev/tools lists, with their successors), the job store is in the tools database, and the T8 state is current (better-sqlite3 only in scripts/).OpenVibers · 29 Sept 2026
cf706b6 -
Tools on PostgreSQL, part 2 (plan T8, phases 1 and 4; not deployed yet): the network and dev pages call the tools run API (/api/v1/tools/<id>/run) instead of /api/net and /api/dev, a signed-in person's probe is a normal quota-metered run and a signed-out visitor gets a sign-in card for probes (port, ping, latency, traceroute, mtr) while lookups stay open; the guard's day counters, salt and buckets live in Valkey (two processes share one budget; an outage test). npm test 57/57 and test:pg 57/57 (verified). The job store on openvibe-sdk/db and the legacy route deletion follow before the deploy.OpenVibers · 29 Sept 2026
c740ca9 -
Tools on PostgreSQL, the groundwork (plan T8): migrations 0001_tools (one tools database for the eight apps: the job store and guard_abuse with app in every key that could collide; guard counters and salt go to Valkey) and 0002_analytics; scripts/migrate-to-postgres.js imports every app's SQLite files into it with per-table counts and checksums (rehearsed on PGlite: every table reconciled); scripts/guard-abuse-report.js (Phase 0: only reason=quota was ever recorded in report mode); the img, docs and audio pages lose their dead /api/process fallback (they submit through OVJobs, as production already did). npm test 57/57 (verified).OpenVibers · 29 Sept 2026
58f8b51 -
X-Internal-Key is gone from Tools (plan T2): GET /api/internal/analytics[/bots] on the gateway and the seven tool sites take only a Network service token with tools.analytics.read (401 token.missing without one), loopback only; the gateway forwards only the caller's Bearer. apps/_shared/internal-auth.js is deleted (loopbackOnly moved into internal-token.js); INTERNAL_API_KEY/OV_INTERNAL_KEY leave .env.example and the README. Tests: the key alone and a bad Bearer beside the key are 401, the token passes and is forwarded, and no server file reads the key. npm test green (verified).OpenVibers · 29 Sept 2026
139ece3 -
README and STATUS.json are current (roadmap WS-U task 3): the README gains Purpose (the opening overview), Owns, Does not own, Depends on (the per-app pins: contracts v0.63.0, sdk v0.12.0, shared v1.23.0), Capabilities (the six tools.* capabilities and the grants Tools uses at Media, Events and Search) and Security (SECURITY.md, the guard, egress, auth, secrets by name) sections; Deploy opens with sudo ovhost deploy tools and the rollback. Stale facts corrected: pages load the shared files from their own app's pinned copy (since 390d3df), not openvibe.network, and the SDK test uses the pinned SDK, not v0.6.0. STATUS.json is new, in the shape of Search's, updated 2026-09-28.OpenVibers · 28 Sept 2026
4f4ed6e -
Per-actor rate limits in every Tools app (roadmap WS-R task 4, openvibe-sdk v0.12.0 limits; openvibe-tools-shared 1.2.0), only where the guard has no per-caller limit of its own. apps/_shared/actor-limits.js makes one limiter per app from the SDK the app passes in (apps/_shared takes no dependencies). It reads the guard's resolved caller: a person as user:usr_…, a service or app by its principal, a browser session or nobody by the guard's hashed address key, so no raw address is ever logged. The guard, its tiered quotas, the older express-rate-limit limiters and TOOLS_GUARD are unchanged. Past a limit a route answers 429 problem+json rate_limited with Retry-After, logs one [Limits] line and counts tools_rate_limited_total{limit,window}.OpenVibers · 28 Sept 2026
e55469f -
deploy/scripts/deploy.sh hands over to ovhost deploy tools (OpenVibe.Host strategy multi-app; roadmap WS-N task 11). The old script is kept, unchanged, as deploy/scripts/deploy-legacy.sh. ovhost does what it did (untracked lockfiles the release tracks removed first, per-app installs with apps/_* skipped, every dependency resolves, the jobs runtime in img/audio/docs and the guard in every app load, data/ made, every openvibe-tools* unit restarted) and adds an automatic rollback, /api/ready with the new sha on the gateway's /release.json and every unit active, freezes and the release log. The wrapper passes --wait-idle, --restart, --force, --rollback and DRY_RUN=1 (ovhost plan tools); it asks ovhost capabilities tools first and runs deploy-legacy.sh, saying why, when ovhost is missing, too old or the host inventory does not deploy tools with multi-app (OVHOST_LEGACY=1 forces it), refusing --rollback, --wait-idle and DRY_RUN there rather than ignoring them. apps/_shared/test/deploy-wrapper.test.js; apps/_shared/test/version.test.js checks the apps/_* skip in deploy-legacy.sh and that the wrapper only hands over to multi-app. README.OpenVibers · 27 Sept 2026
5768232 -
Project usage rollups (roadmap WS-N task 4; Contracts v0.63.0 tools.usage.recorded, common.usage-recorded@1): a developer app's job (it carries a project) that ends is counted in the transaction that records its end (apps/_shared/jobs/usage.js, table tool_job_usage in the satellite's jobs.db), per project, environment, capability (tools.tool.run for a tool run, tools.job.create for POST /api/v1/jobs), job type or tool and UTC hour: jobs that ended (succeeded or failed; cancelled ones are not counted) and the failed ones by problem code, with the last ten failures' job id, status and the trace id of the request that submitted the job (new tool_jobs.trace_id, kept by submit({ traceId }) from jobs/http.js and tools/run.js). A minute after an hour closes, the pruner's timer writes each rollup once to the satellite's outbox as tools.usage.recorded (subject the project, visibility internal, priority low) in the transaction that marks it sent; a job ending in an hour already sent re-sends it as revision 2. Sandbox jobs count under env sandbox. No owner, session, address, input, file name or output leaves. Inert without EVENTS_URL, like the job events; GET /api/health shows jobs.usage. openvibe-tools-shared 1.0.0 -> 1.1.0 (additive). Pins: openvibe-contracts 0.49.0 -> 0.63.0 (audio, docs, gateway, img). test: apps/_shared/test/job-usage.test.jsOpenVibers · 26 Sept 2026
f15b263 -
apps/_shared is a versioned package, openvibe-tools-shared 1.0.0 (roadmap WS-L task 3, the last part): package.json and CHANGELOG.md carry its version, and every app declares the range it was written against ("openvibeToolsShared": "^1.0.0" in its package.json). The apps still require it by relative path from the same checkout, so the declaration is checked at boot: toolsRelease() calls requireShared(app), and an app whose range this checkout does not satisfy refuses to start. A breaking change bumps the major and every app's range in the same commit. test: apps/_shared/test/version.test.jsOpenVibers · 26 Sept 2026
37e6cf3 -
Release notification: the event ovhost announce publishes is host.release.published (its own type in openvibe-contracts 0.58.0; host.deploy.activated stays tenant hosting's), in the deploy script's comment and the README. Comments only (WS-P task 9)OpenVibers · 26 Sept 2026
c25ba2b -
Release notification after a deploy (roadmap WS-P task 9): deploy.sh runs `ovhost announce tools` once the gateway is healthyOpenVibers · 26 Sept 2026
782ed60 -
openvibe-contracts v0.33.1 (gateway, img, audio, docs) and openvibe-shared v1.5.1 (every app). Descriptors now publish the catalogue's keywords (every tool; what ?q= matches) and each API tool's example as examples[] (145 tools; a job tool's with sample files that fit files.min and files.accept), which v0.33.1 validates and v0.33.0 rejected; no API, no examples. Every app mounts release.mount (GET /release.json and the navbar's POST /release-metrics into release_client_updates_total) through apps/_shared/release.js, which declares each app's components: shell (public/, the server files that stamp its pages, the job helper) and server (the rest), so an API-only release no longer reloads open tabs; the gateway, img, audio and docs serve manifest 1.1.0 validated against their own contracts (the release-manifest schema passed explicitly: the release root is the repository, which has no node_modules), maps, food, text and yt the 1.0.0 fields. Tests: release.test.js (components valid per app, mount, metrics), descriptors.test.js (keywords and examples published)OpenVibers · 24 Sept 2026
5ac8309 -
Uniform run API, jobs facade, deprecation headers and the Origin check (S6, ADR-027). POST /api/v1/tools/:id/run takes tools.run-request@1 as JSON or multipart exactly as openvibe-sdk v0.6.0 sends it (uploads as file parts; input, files (the references' JSON), wait_ms and idempotency_key as text parts; ?wait_ms= too; the Idempotency-Key header wins) and answers tools.run@1: 200 succeeded or failed (the tool's own problem), 202 + Location while a job tool is still going after wait_ms, 200 + Idempotent-Replayed for a replay. Refusals are problem+json with the contract's codes: 400 tools.run.invalid, 401 token.missing/token.invalid/tools.session_required, 403 capability.denied/tools.origin.refused, 404 tools.tool.not_found/tools.tool.not_runnable (api false: yt, regex…)/tools.run.file_not_found, 405, 409 tools.job.idempotency_conflict, 413 tools.file.too_large/tools.input.too_large, 415 (bytes sniffed), 422 tools.input.invalid with errors[] (the descriptor's input schema, Ajv from openvibe-contracts), 429 tools.quota.exceeded, 503 tools.tool.unavailable (descriptor status) vs tools.unavailable (the engine found a program missing), 503 tools.busy. Authorization is always enforced: a token needs the descriptor's auth.capability, network probes run only for tokens with tools.net.probe, auth.anonymous false needs a session, sign-in or token; quotas are the tool's class and cost per caller tier. The gateway answers for every tool: dev and text engines run the pages' code in a worker pool (terminated at the descriptor's timeout), net tools and Open Graph call their existing route in process (myip is the caller), both cached per tool where safe (spec cacheTtlMs: engines 10 min except random/time-dependent ones, slow lookups 1-60 min, never probes or live checks), inline Idempotency-Key replays for 15 min; img, audio and docs tools are streamed to their satellite, which runs them as jobs (job input { ...input, ...preset, tool: operation }; jobs now record the tool), with { job_id, index } references read across satellites under the owner's own credentials and { media_id } from the owner's Media-stored results. The gateway's /api/v1/jobs facade routes submits by type prefix (JSON, the multipart type part read from the stream head, or ?type=) and everything else by job id (remembered, else asked on loopback via GET /api/internal/jobs/:id, direct callers only and never limited), streaming events and files. /api/process…, /api/net/* and /api/dev/* keep their shapes and add Deprecation: true, Sunset: Thu, 31 Dec 2026 23:59:59 GMT and Link: </api/v1/tools/{id}/run>; rel="successor-version". The guard checks Origin (else Referer) on cookie-carried mutations (run API, job writes, /api/process…, /api/info, /api/probe, webhook bin create/delete): first-party *.openvibe.tools, the tool's own hosts and the same host pass, Bearer calls and cookie-less calls need nothing; 403 tools.origin.refused in enforce mode, recorded in report mode. Run and jobs routes give other sites' pages CORS without credentials. On /api/v1 the older limiters answer problem+json with Retry-After; img and docs let untyped upload parts through to the guard's sniffing (as audio did); refused uploads are deleted before the answer. Pool fix: a worker that errors (heap limit) leaves the pool at once, so no run is handed to it before its exit. nginx copy: a location for the run and jobs routes (512m uploads, no buffering, 600 s). Tests: run-api.test.js (gateway, img, docs, a stand-in Network: every answer checked against tools.run@1), jobs-facade.test.js, sdk-client.test.js (openvibe-sdk v0.6.0 createToolsClient against the real gateway: registry, sync run, job run + wait + file, waitMs, replays, a job reference img → docs, retry, a probe token; skips without an SDK checkout), guard Origin cases; the audio poll and the tools-api ETag checks no longer race on a busy machineOpenVibers · 24 Sept 2026
48605fa