Commits

main

Pins: openvibe-shared 1.18.0 -> 1.20.0 (the update matrix and release manifest 1.2.0: client generations, the shell)OpenVibers · 26 Sept 2026 1907390
Sandbox and developer-app results to Media under the project's namespace (roadmap WS-L task 5): a job submitted by a developer app remembers its project (tool_jobs.project_id), and its result files go to Media under tools.app.<project_id> (production) or tools.app.<project_id>.sandbox, so Media's namespace usage meters each project; sandbox results, kept only on this server before, now reach Media too. A person's or a session's job is unchanged (the tools root). A failed upload still leaves the result here and says soOpenVibers · 26 Sept 2026 04a5876
Pins: openvibe-shared 1.17.1 -> 1.18.0 (update telemetry: prompted count, sessions by generation)OpenVibers · 26 Sept 2026 7487547
Pins: openvibe-shared 1.16.1 -> 1.17.1 (release notifications)OpenVibers · 26 Sept 2026 4238494
Release notification: the event ovhost announce publishes is host.release.published (its own type in openvibe-contracts 0.58.0; host.deploy.activated stays tenant hosting's), in the deploy script's comment and the README. Comments only (WS-P task 9)OpenVibers · 26 Sept 2026 c25ba2b
Release notification after a deploy (roadmap WS-P task 9): deploy.sh runs `ovhost announce tools` once the gateway is healthyOpenVibers · 26 Sept 2026 782ed60
Pins: openvibe-shared -> 1.16.1 in all eight apps (was 1.13.0, gateway 1.15.0): the /updates filter chip contrast fix and the OV mark that stops animating when idleOpenVibers · 26 Sept 2026 ea03851
Tool pages: the "Primary" address tag on the highlighted row is --text-primary instead of --text-muted, which read 3.16:1 on the accent glow (axe color-contrast serious on /tool/yaml and every tool page; found by the browser check, WS-Q task 3)OpenVibers · 26 Sept 2026 858845c
Family pages' "Open …" button (.cta) is --on-accent-strong on --accent-strong (openvibe-shared 1.13.0 tokens, 4.5:1 in every theme) instead of white on --accent (3.67:1, axe color-contrast serious on /network-tools, /developer-tools, /image-tools; found by the browser check, WS-Q task 3)OpenVibers · 26 Sept 2026 f0307c0
/developers: long commands scroll inside their code blocks instead of widening the page (858 px wide at 768 px, found by the browser check, Host scripts/browser-check.js, WS-Q task 3), and each block is focusable with a visible focus ring so a keyboard can scroll it; test: apps/gateway/test/developers-page.test.jsOpenVibers · 26 Sept 2026 2140ef5
Graceful stop for every Tools process (WS-P lifecycle follow-up): apps/_shared/graceful.js on SIGTERM/SIGINT stops timers, pollers and the job worker first, then stops taking connections, closes idle keep-alive ones, answers requests in flight with Connection: close and closes event streams (EventSource reconnects), lets requests finish for 4 s at most, then closes databases and pools and exits 0 (exit 1 only past the 5 s deadline). The gateway had no handler at all (Node's default ended it at once, cutting requests); it now stops its catalog, services and satellite pollers and the search indexer, flushes recent-tool writes (1 s at most), closes the engine pool, the guard and the cutoff store. The seven satellites used to close their analytics, jobs and guard databases before the HTTP server finished, under requests still running, and force-exit 1 after 5 s; they now drain first and close after. test: _shared/test/graceful.test.js (the helper on a plain server; every one of the 8 processes, SIGTERM with a request in flight: answered, no new connections, exit 0 in < 5 s)OpenVibers · 26 Sept 2026 93f0f6c
Size budgets for the home page (WS-T task 1): openvibe-shared/perf-budget (gateway on shared 1.15.0) measures the gateway's / as it runs, no browser, in npm test; budgets a little above the 2026-09-26 measurement (html 135 KB / 19 KB brotli, js 208 KB)OpenVibers · 26 Sept 2026 78b8f8f
Favourites for everyone (WS-L task 1): without an account a browser keeps its starred tools in the ov_tool_favs cookie on the tools zone (24, newest first) and they join the account's favourites once at sign-in; stars on search results as well as Your tools; favourites rank first in results; Ctrl+K (or /) on an empty search opens Your favourites, Escape goes backOpenVibers · 25 Sept 2026 db18e70
Network diagnostics family acceptance (WS-L task 6): every net tool, taken from the registry, has a tools.tool@1 entry on its own host (input and route, or a stated reason when unavailable), help content (title, description, intro, bullets, FAQ), and never connects to loopback, private, metadata or rebinding targets; the 13 tools that connect to their target refuse them with tools.net.target_not_public; a direct socket or system DNS lookup outside the egress guard fails the testOpenVibers · 25 Sept 2026 195e8ce
Tools home: the search button uses the derived --accent-strong pair (4.5:1 in every theme), and planned tiles dim their icon instead of their text (the tagline read at 3.2:1) — WS-T task 3OpenVibers · 25 Sept 2026 0b14739
Pins: openvibe-contracts 0.44.0 → 0.49.0, openvibe-shared 1.12.0 → 1.13.0, openvibe-sdk 0.9.1 → 0.11.0OpenVibers · 25 Sept 2026 9d3b267
nginx: every Tools vhost includes the platform's /.well-known/security.txt in its serving block, as production already does (WS-R task 7); the SDK client test compares versions numerically (0.11.0 is later than 0.6.0)OpenVibers · 25 Sept 2026 cca0d82
CI: no npm cache at the root (there is no root lockfile; each app installs its own)OpenVibers · 25 Sept 2026 db31b43
CI on the shared test and security workflows (WS-Q task 1, OpenVibe.Shared 66b76f8): install, node --check, tests, contract and pin-drift checks from one definition; this repository's own steps kept as inputs and extra stepsOpenVibers · 25 Sept 2026 c73d4dc
Pins (every apps/* package): openvibe-contracts 0.33.1 → 0.44.0 (audio, docs, gateway, img), openvibe-sdk 0.4.0 → 0.9.1 (audio, docs, img; gateway already 0.9.1), openvibe-shared 1.11.1 → 1.12.0 (audio, docs, food, img, maps, text, yt; gateway already 1.12.0); CI runs the pin-drift checkOpenVibers · 25 Sept 2026 4bbfd62
Favourite tools (tools.usage v2, Contracts 0.41.0, WS-B task 9): the launcher's Your tools shows starred tools first with a star on each card, PUT/DELETE /api/v1/me/favorites/:tool, /api/v1/me/recent-tools returns favorites; every recent-tools write keeps the record's other fields (it replaced the whole record, which would have dropped favourites starred on my.openvibe.network)OpenVibers · 25 Sept 2026 df821b3
Sign-out everywhere cutoffs live in apps/gateway/data (the gateway unit's ReadWritePaths; /opt/openvibe.tools/data was unwritable and every delivery answered 500), in a rollback journal so the read-only apps under ProtectSystem=strict can open itOpenVibers · 25 Sept 2026 f4926b0
Sign-out everywhere across Tools (WS-B task 4, SDK 0.9.1): the gateway consumes network.user.token_valid_after (POST /internal/events, TOOLS_EVENTS_SECRET, signature v2, never through the proxy) into a shared SQLite file (TOOLS_REVOCATIONS_DB, default <repo>/data/token-revocations.db); every app's guard reads it and treats a token issued before the person's cutoff as nobody signed in; the subscription is created at boot. test: apps/gateway/test/revocations.test.jsOpenVibers · 25 Sept 2026 ab20dc4
Guest conversion for the launcher (WS-B task 8): the first time an account asks for its recent tools from a browser, the tools that browser used as a guest (ov_recent_tools) join the account's tools.usage list, once per account and browser (HttpOnly ov_recent_merged marker)OpenVibers · 24 Sept 2026 bfa8c2e
The Tools gateway serves its own pinned OpenVibe Frame files at /shared/* (openvibe-shared/serve 1.12.0) and its server-rendered pages reference them by content hashOpenVibers · 24 Sept 2026 2b5104f
The shared update system on openvibe.tools: the home shows what shipped and /updates is the shared log (openvibe-shared/frame shipped()/updatesBody(), same markup as every OpenVibe site), the footer links it, /updates is in the sitemap; every app on openvibe-shared 1.11.1 (the satellites were on 1.5.1)OpenVibers · 24 Sept 2026 e46e1d2
Network-tool SSRF guard on openvibe-shared 1.6.0 (platform S9, egress consolidation): the public-address rule, internal names and host normalisation come from openvibe-shared/egress, the rule Live and Events use; createEgress keeps the connect-to-the-checked-address transports, per-target throttles and TargetRefused. Gateway pins openvibe-shared v1.6.0OpenVibers · 24 Sept 2026 d1a5f87
Recent tools in the launcher (D31: anonymous and account history): every tool page view puts the tool on top of this browser's ov_recent_tools cookie (first-party, .openvibe.tools, 12 ids, no page script needed across tool hosts); GET /api/v1/me/recent-tools answers a signed-in person's tools.usage module (plus what is not yet flushed) or the cookie list, registry-filtered and never cached; the home page shows 'Your recent tools' (every device, or this browser) and Ctrl/Cmd+K focuses searchOpenVibers · 24 Sept 2026 557de61
tools.usage: a first record is written with If-Match 0, so two apps creating it at once cannot overwrite each otherOpenVibers · 24 Sept 2026 aa1389f
Tools in Search and in people's recent tools (platform S9). Search: every available tool is a search.index-document@1 (owner tools, type tool) written through Search's owner API with the tools service token (search.document.write), a minute after boot and every 6 hours; re-sent one revision above Search's stored one only when its content changed (data/search-index.json), tombstoned when it leaves the registry. /api/health shows search_index. SEARCH_URL enables it, TOOLS_SEARCH_INDEX=off disables it. tools.usage: a signed-in person's page view of a tool (every app, after guard.identify) or run API call puts the tool at the top of their Network module tools.usage ({ recent: [{ tool, at }] }, 30 at most): once per tool per 10 minutes, flushed every minute as one read and one If-Match write per person, merged with other writers; a 412 retries on the next flush. apps/_shared/usage.js, dependency-free. TOOLS_USAGE=off disables it. Tests: apps/gateway/test/search-index.test.js, apps/_shared/test/usage.test.jsOpenVibers · 24 Sept 2026 1a8d739

More commits