Commits

main

SSRF: the network tools refuse internal targets. apps/_shared/egress.js (from OpenVibe.Events) checks every resolved address after DNS (loopback, RFC 1918, link-local and 169.254.169.254, CGNAT, 0.0.0.0/8, multicast, documentation/benchmark, ULA/site-local v6, v4-mapped/NAT64/6to4/Teredo wrapping those) and dials only the checked address (IP literal + SNI for sockets, a pinned lookup for HTTP, so no rebinding)OpenVibers · 23 Sept 2026 f9a1441
Analytics within ADR-021 on every satellite: apps/_shared/analytics replaces the openvibe-shared tracker (no IP, user id or city in raw events; route templates, referer origins, user-agent classes, rotating session ids); raw events pruned after 30 days on a 24 h timer, rollups keptOpenVibers · 23 Sept 2026 533c9a3
Jobs accept developer-app sandbox tokens (apps only; other sandbox tokens 401), store env, sandbox jobs capped at 2 active and 30 min, results never sent to Media; openvibe-contracts v0.28.0 (sandbox refused by default elsewhere)OpenVibers · 23 Sept 2026 43f71e4
Metrics and truthful readiness on the gateway and every satellite (Track O): openvibe-shared v1.3.0; GET /metrics for direct loopback callers only (route templates, proxy:<app> on the gateway, tools_jobs{app,state}); GET /api/ready with required vs optional checks (job store, job runtime, writable dirs; Network key, binaries, Media results, satellites and Community optional → degraded); nginx 404s /metricsOpenVibers · 23 Sept 2026 70e9a19
deploy.sh removes untracked npm lockfiles that the incoming release tracks, instead of failing the pullOpenVibers · 23 Sept 2026 a6374a8
GET /release.json on the gateway and every satellite (ADR-016); openvibe-shared v1.2.0OpenVibers · 23 Sept 2026 e88f7a2
openvibe-contracts v0.11.0 (tools.job.* released)OpenVibers · 23 Sept 2026 fab9f4c
Docs: jobs API, durability, owner scoping, Media results and their grants, canonical hosts, registry catalog, tests; tools.job.* capability and service manifest proposalsOpenVibers · 23 Sept 2026 f5d27df
The catalog resolves other services through Network's registry (GET /api/v1/registry/services, cached, last good kept, local list as fallback and labelled as such); placeholder and retired services are not linkedOpenVibers · 23 Sept 2026 7feff8e
Maps, Food and Text honour X-OV-Canonical-Host: canonical, og:url and JSON-LD follow the gateway, custom domains get their tool through X-OV-Tool, gateway aliases redirect, unknown hosts go to the tools indexOpenVibers · 23 Sept 2026 b6c9d9f
Durable jobs on Img, Audio and Docs: /api/v1/jobs with SSE progress, cancel, reattach, idempotency keys and owner scoping; results can be Media objectsOpenVibers · 23 Sept 2026 7b76c41
Tools deploy checks every app resolves each dependency before restarting; an emptied file: link reinstalls instead of crash-looping all unitsOpenVibers · 23 Sept 2026 f6deae8
openvibe-shared is the pinned OpenVibe.Shared v1.0.0 release in every app; the vendored copy and the deploy rsync are goneOpenVibers · 23 Sept 2026 4773f7b
Paste gateway talks to OpenVibe.Community directly (it owns pastes since the Wave 5 cutover); the visitor's JWT and address go alongOpenVibers · 23 Sept 2026 fd5d318
vendor sync: openvibe-shared navbar + ring icons now draw solid Font Awesome glyphs (no FA CSS dependency)OpenVibers · 21 Sept 2026 0346edc
vendor sync: shared navbar (drawer, chips, sections)OpenVibers · 18 Sept 2026 fb22b98
Remove the retired paste page and the unused hand-written sitemap code (both replaced by the registry and Community)OpenVibers · 18 Sept 2026 fd0f1a4
vendor sync: shared user menu and panel coordinatorOpenVibers · 18 Sept 2026 9c92ec4
Icon sprite on server-rendered pages; footer baked into the HTML; vendor syncOpenVibers · 18 Sept 2026 eb7161c
vendor: Footer carries its own inline icons (no dependency on the page's icon font)OpenVibers · 18 Sept 2026 4b73b35
vendor sync: navbar panels stay inside the viewportOpenVibers · 18 Sept 2026 cea8023
First paint never waits on the Network: inline dark canvas + cached-theme boot in the shared head tags, theme script deferred (43 tool pages); legacy paste host hands over to Community with the slugOpenVibers · 18 Sept 2026 cf941d8
Twelve single-purpose tools (JS/CSS/HTML/XML/JSON minifiers, JS/CSS beautifiers, JSON parser/validator/stringify, HTML↔Markdown) on descriptive + short hosts; tool id resolved server-side for any hostOpenVibers · 18 Sept 2026 b32bcfb
One entry per tool: duplicate builds folded into mirrors (200, canonical → primary, unlisted); owner-settable mirror role; cards link the SEO host and take people straight to the short oneOpenVibers · 18 Sept 2026 20c01d1
People on a canonical host are sent to the short host, crawlers stay; YT status uses the shared notice; vendor syncOpenVibers · 18 Sept 2026 d157bf4
vendor: Icons: hover keeps the glyph in place, every glyph optically centred from measured bounds; legal documents rewritten with site-specific clauses and a table of contentsOpenVibers · 18 Sept 2026 4281f17
YT: periodic upstream self-check, status in /api/health and a banner while YouTube refuses the server; README explains the two ways outOpenVibers · 18 Sept 2026 073c6ff
Icon set, manifest and shared head tags on all 45 tool pages; vendor syncOpenVibers · 18 Sept 2026 9a214d2
Internal analytics need the deployment's INTERNAL_API_KEY and a loopback caller (the repo-visible shared secret is gone); gateway aggregates satellite analytics; tool hosts redirect legal paths to the apexOpenVibers · 18 Sept 2026 845669c
vendor: Favicon and browser theme colour follow the user's theme and update live (this tab, other tabs, server sync)OpenVibers · 18 Sept 2026 7eeb73b

More commits