A members-only hub plugin (the BBS "who") plus user-to-user messaging:
- internal/store: messages table + SendMessage/Inbox/UnreadCount/MarkRead, and
OnlineUsers (open sessions) for presence. MarkRead is recipient-scoped so a
member can only clear their own mail.
- plugins/members: directory with online dots + last-seen, a finger-style
profile view, a minimal compose box, and an inbox that marks read on open.
- ssh msg@host <user> [text]: scriptable CLI to leave a note (body from args or
stdin), mirroring the existing finger route; "msg"/"message" are reserved.
- hub: "N unread" badge on login (hubMOTD). plugin.Context gains Host for member
homepage URLs.
Extends the existing finger@ behavior (ssh <name>@host) rather than replacing it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The deploy SSHed into the ~458MB droplet and ran `go build` there. The Go
linker's peak memory OOM-killed the build — and with it the sshd serving the
deploy session — surfacing as "Connection closed by remote host" (exit 255).
It was flaky because it tracked momentary memory pressure from the co-resident
ergo/forgejo/tor/podman/agentbbs processes (run #25 passed, #26 failed on
near-identical code).
Build both binaries on the 16GB GitHub runner instead (pure-Go, modernc
sqlite, so CGO_ENABLED=0 static cross-build), scp them to the droplet, and run
setup.sh with SKIP_BUILD=1 so the box never compiles. Arch is detected from
the droplet so amd64/arm64 both work. setup.sh now also skips the Go toolchain
download when SKIP_BUILD=1.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The box auto-deploys (self-update timer pulls origin/main, rebuilds, restarts
agentbbs), but `systemctl restart agentbbs` only restarts the daemon — it never
touches the long-lived per-user pod containers. ensure() also short-circuits on
any container that already exists, so pods created before the homepage bind
landed would never gain the /home/dev/public_html mount without a manual
`podman rm`. That defeats the "everything happens automatically on push" goal.
Make ensure() self-healing: when a pod exists but lacks the public_html mount,
recreate it so the bind is applied. The named home volume survives `rm`, so the
member's files are kept. Only heal when the pod is idle (attached count 0) to
avoid pulling a running pod out from under an active session — an unbound pod
heals on its next idle attach. New hasMount() inspects the container's mounts.
Net effect: push to main -> self-update redeploys within the timer interval ->
the next `ssh pod@` recreates the pod with the bind. No manual step.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A member's pod home (/home/dev) is a named container volume, but Caddy serves
<name>.<host> from the host path <data>/users/<name>/public_html. The two were
disconnected, so editing ~/public_html/index.html in the pod never changed the
served page — contradicting the on-screen "edit ~/public_html to make it yours"
instruction.
Bind-mount <data>/users/<user>/public_html at /home/dev/public_html when pods
start. The host tree is created if absent so the mount source exists, and under
the docker fallback (uid 1000) the one-shot init container now also chowns the
bind path; rootless podman maps container root to the host service user that
already owns the tree, so no chown is needed there.
Detect now takes the host users dir; pass "" to disable the bind.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
flipLastChar toggled only the last base64 char of the signature segment.
For a 64-byte Ed25519 signature that char carries unused trailing bits, so
the toggle could decode back to the same bytes and still verify — making the
"corrupted signature must fail" assertion flaky (it reddened main CI).
Corrupt a decoded signature byte (sig[0] ^= 0xFF) and re-encode instead, so
the signature always differs. Verified deterministic over 50 runs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the figlet "profullstack.com" wordmark with a scaled-down ASCII
rendition of the Profullstack </> mark (derived from the brand image),
shown on the join@ onboarding and the ssh <name>@ hub. Reuses the existing
banner plumbing; the mark is sourced from internal/brand and rendered in
Profullstack red.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Members get a real <name>@mail.profullstack.com mailbox, served by a
co-located Mailu (Postfix+Dovecot+Roundcube+rspamd) Docker stack. Coexists
with the host Caddy: Mailu owns the mail ports; Caddy fronts the loopback
webmail and supplies the TLS cert (TLS_FLAVOR=mail), the same cert-copy
pattern as the Ergo/IRC and NNTP services.
- deploy/mailu/: docker-compose.yml, mailu.env.example, refresh-certs.sh
(copy Caddy's mail cert into Mailu on renewal), provision-mailbox.sh
(member mailbox + Dovecot gateway master user), README.
- setup.sh: MAIL flag + mail.${DOMAIN#*.} Caddy site + §9e (cert timer,
mail-port firewall, conditional compose bring-up, AGENTBBS_MAIL_* env).
- docs/mail.md: architecture, DNS (MX/SPF/DKIM/DMARC/PTR), gateway
master-user setup, env, provisioning, webmail-only policy.
Apex profullstack.com stays corporate; member mail is only on mail.*.
Infra is inspection-verified (bash -n, YAML lint); deploy pending.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rework the IRC access model to the user-level source of truth — the
bbs.profullstack.com user store — per the agreed design:
- Auth via the store, not OS users. New loopback endpoint /irc-auth (on the
/verify server) answers {member,premium} from the store via UserByName. Ergo's
auth-script now curls it instead of `getent passwd`; the OS-user (tilde.town)
reconcile in setup.sh is reverted. require-sasl on, registration off.
- Remove the in-BBS `ssh irc@` route: delete internal/irc (in-process client +
TUI), handleIRC/runIRC, the hub IRC menu entry, and the dispatch case. Members
connect with an external client (or web) at irc.profullstack.com:6697 / wss.
IRCNames kept only to reserve the "irc" name (IsIRCName removed).
- Keep external clients; keep the irc.profullstack.com hostname + cert work.
Premium channel creation: /irc-auth already returns each account's premium
status, but enforcement is NOT yet wired (the old irc@ /create was removed with
the route; Ergo can't gate creation per-account natively). operator-only-creation
stays off for now; server-side premium gating (a ChanServ-style bot) is a
documented follow-up. See docs/irc.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
UX pass on the single-login hub:
- ctrl+c now always returns to the main menu from any in-hub plugin/game
instead of being forwarded. Fixes the snake game being un-exitable (it never
handled ctrl+c) and makes "back to menu" uniform across every screen.
- profullstack.com ASCII banner rendered atop the hub menu and the join@
onboarding flow.
- MOTD box under the title (guest vs member tailored; AGENTBBS_MOTD overrides
the body).
- New "Shell" hub entry drops straight into `bash -l` in the member's pod; the
existing "Pod" entry now attaches to the pod's main session.
- Polish: highlighted selection + ❯ cursor, brand colors, clearer footer.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Hostname: serve the network as irc.profullstack.com (new IRC_DOMAIN var,
default irc.<root-of-DOMAIN>). Caddy serves an irc.profullstack.com site so it
gets a Let's Encrypt cert; ergo-refresh-certs copies that into Ergo for 6697.
Needs an A record irc.profullstack.com -> the box (self-signed until it resolves).
Members are OS users (tilde.town model): setup.sh reconciles a real OS account
per member dir (root-side, on each deploy + the 15-min timer; nologin shell, so
identity-only — no shell access). The IRC auth-script now gates on
`getent passwd` with uid>=1000 instead of the member dir, so "OS user" == member.
Premium channels: free members may /join; creating channels is a premium perk.
The ssh irc@ client gains /create #name (premium-gated via ensurePremium): it
joins the fresh channel and registers it with ChanServ as the member's founder.
v1 gate is route-level (operator-only-creation left off); external-client
creation hardening is a follow-up. See docs/irc.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The join@ output and hub previously pushed members to ssh into separate
servers (ssh pod@, ssh irc@, ssh news@, ssh tor@). Members now reach
everything from one `ssh <name>@bbs.profullstack.com` login:
- hub: new SessionApp entries (Pod, IRC, News, Tor shell) run as
terminal-takeover features via tea.Exec, then return to the menu.
Gated by membership/email-verification/plan; shown locked otherwise.
- main: build the session apps in teaHandler; extract runIRC/runNews so
the irc@/news@ routes and the hub share one path. The old pod@/irc@/
news@/tor@ routes stay as aliases (handy for bots).
- onboarding: rewrite the "You're in" and Founding-Member copy to present
ONE login and stop advertising separate servers.
- email: member mailboxes move to mail.profullstack.com (apex reserved
for corporate mail); webmail shown at https://mail.profullstack.com.
- username: harden the default handle to a safe /home/<name> token.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Brings the AgentGit provisioning wiring (provisionGit hook in both email-verify
paths + setup.sh Forgejo backend section) and the v0.1.0 stack version onto main.
The internal/forgejo package was already on main but unwired; this connects it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The internal/forgejo package landed without its call sites. Restore them:
- main.go: provisionGit() called after both email-verify paths (web link +
interactive code), the forgejo.Config app field, and ConfigFromEnv wiring.
Every verified member (free + paid) gets a git.profullstack.com account;
failures are logged, never block verification; no-op when unconfigured.
- setup.sh §9d: install + run the Forgejo backend on a loopback port fronted
by Caddy at https://git.<root>, members-only, with an admin token minted
into agentbbs.env. Caddy vhost + done-banner + env template entries.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New members must read a short terms notice and type "agree" before an
account is created. The terms state that AgentBBS is for lawful use only,
that illegal activity results in an immediate permanent ban (and may be
reported), and that members are responsible for what they and their agents do.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the $10 "Premium" pitch with a $99 Founding Lifetime Member
offer (first 1,000 accounts) and list every bonus feature in the join@
upgrade prompt: personal email + webmail, custom domains, Tor access,
and lifetime locked-in pricing.
- payments: PremiumPriceLabel/default amount $10 -> $99, add FoundingCap
- join@ offer + already-paid welcome + gated-route upsell copy
- README + interface doc comments
Price stays env-overridable via AGENTBBS_PREMIUM_AMOUNT.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Brings the in-process IRC client (internal/irc) and the `irc@` SSH route on
top of the already-merged members-only Ergo server, completing the IRC
feature. The other commits on the branch (Ergo server, Tor routes) were
already merged via feat/qrypt-invite-issuer, so this applies only the client.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The live CoinPay API returns crypto_amount as a bare JSON number (e.g.
0.0031), but the struct decoded it as a string, so /payments/create failed
with "cannot unmarshal number into ... crypto_amount of type string" and
join@ showed "Payment is temporarily unavailable". The unit test had hidden
the bug by sending the value quoted.
Add a flexStr type that unmarshals from either a JSON number or string and
use it for crypto_amount; update the test to send a number and add a direct
flexStr decode test for both forms.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds an in-process IRC client (internal/irc) and an `irc@` SSH route that
drops a member straight into the BBS's own Ergo network with no client to
install and no SASL to configure.
- internal/irc/client.go: minimal IRC client (SASL PLAIN, IRCv3 CAP, PING,
PRIVMSG/JOIN/PART/NICK, event stream). Dials Ergo on the loopback
127.0.0.1:6667; presents the member's account name (the SSH key already
proved membership; Ergo's auth-script ignores the passphrase by design).
- internal/irc/tui.go: Bubble Tea TUI over the SSH PTY (mirrors internal/chat)
with /join /part /msg /me /names /nick /help and a current-channel input.
- cmd/agentbbs: handleIRC resolves the member by key (members-only, free) and
runs the client; routed via auth.IsIRCName. AGENTBBS_IRC_ADDR overrides the
target on dev hosts.
- auth: reserve `irc` as a route name.
Unlike copying tor-irc@ (a third-party client in a pod), this runs our own Go
code in-process, so there is no /exec shell-escape surface, and the host
process can reach Ergo's loopback listener directly.
Validated live against a members-only Ergo: non-members are rejected, a member
authenticates via SASL, and channel messages are received.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ssh join@host requests a PTY by default, so the client's terminal goes into
raw mode: it sends keystrokes as they're typed (Enter is '\r', not '\n') and
does no local echo. The onboarding prompts (username, email, code) read with
bufio.ReadString('\n'), which never sees a '\n' and blocks forever — the user
sees a dead prompt at "Email:". The earlier "require a PTY" change made this
guaranteed rather than intermittent.
Add a readLine helper that reads byte-by-byte, treats '\r' or '\n' as the
line terminator, handles backspace, and echoes printable bytes back so the
user can see what they type. Route the three onboarding prompts through it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Provision a self-hosted Ergo IRC network (irc.${DOMAIN}) in setup.sh §9b:
single Go binary on its own ports/user, reusing Caddy's Let's Encrypt cert
for 6697 TLS (refreshed by a timer; self-signed fallback on first boot),
loopback 6667 + a loopback WebSocket fronted by Caddy at wss://${DOMAIN}/irc.
Access is MEMBERS-ONLY: every client must authenticate with SASL, self-service
registration is off, and an auth-script (deploy/ergo/auth-script.sh, installed
as /usr/local/bin/ergo-auth-member) approves a login only if the account name
maps to an existing AgentBBS member home dir under <data>/users/. Passphrase is
ignored — membership (the filesystem dir) is the credential. require-sasl has
no IP exemption so WebSocket clients (which reach Ergo via Caddy from 127.0.0.1)
can't bypass the gate; accounts are auto-created on first successful auth.
Public attack surface is TLS-only (ufw opens 6697; 6667 is loopback). Toggle
with IRC=0. See docs/irc.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add three premium-gated SSH routes:
ssh tor-url@host <url> one-shot HTTP(S) GET over Tor (host-side,
curl via SOCKS, 30s/2MB caps, http/https only)
ssh -t tor-irc@host <server> interactive IRC over Tor in the member's pod
ssh -t tor@host <command...> run any command over Tor (torsocks) in the pod
tor-url runs host-side and constrained; tor/tor-irc run inside the member's
isolated pod (new pods.Exec) so arbitrary/interactive commands are sandboxed,
never on the host. internal/tor wraps curl/torsocks/irssi. All gated by
ensurePremium; names reserved. setup.sh installs + enables tor (SOCKS
127.0.0.1:9050) and torsocks.
Note: tor-url is host-side and self-contained. tor/tor-irc still need the pod
image to carry torsocks+irssi and reach the Tor SOCKS — follow-up.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Onboarding hard-coded the account name to member-<fp8>, so everyone got an
unmemorable handle like member-zafztqdk for ssh <name>@host and /~<name>.
New keys are now prompted for a username during join@. auth.SanitizeUsername
folds input to the hub/subdomain charset (lowercase [a-z0-9-], 3–20 chars,
'_'/space -> '-', no doubled/edge dashes); auth.IsReservedName blocks route and
infra labels (bbs/join/pod/domain/admin/agent/video/video-*/www/...). The name
must be free (UserByName) or we re-prompt; pressing enter keeps the member-<fp8>
default. Returning keys keep the name they already chose.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The self-update timer runs setup.sh as a systemd oneshot with no $HOME, so
`go build` aborted with "module cache not found: neither GOMODCACHE nor GOPATH
is set" before compiling — auto-deploys silently pulled new code but never
rebuilt or restarted. On top of that, a cold cache made the 458MB droplet
OOM-kill the compiler.
Set explicit, root-owned, persistent Go caches (/var/cache/agentbbs/{go,go-build})
plus HOME and GOMAXPROCS=1 in setup.sh, and add HOME=/root to the generated
agentbbs-update.service. A warm persistent cache means incremental redeploys
recompile almost nothing, keeping peak memory within RAM+swap; combined with
the existing `go build -p=1` the compiler no longer gets OOM-killed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A Gym-style game engine (PRD §5.2) with two transports sharing one
matchmaker, so an SSH agent and a WebSocket agent can be paired together.
Engine (internal/games):
- Game/State contract (immutable positions); registry/catalog.
- Phase-1 games: Tic-Tac-Toe (ttt) and Connect 4 (c4).
- ELO (K=32, start 1500), a generic win/block/random GreedyBot.
- Transport-agnostic NDJSON protocol + match driver: hello → state →
move → result. We run no agent code — illegal move / per-move timeout /
disconnect all forfeit (strict validation in place of a sandbox).
- Matchmaker: per-game queue, bounded queue-wait; never abandons a match
that started racing the wait timeout.
Transports:
- SSH route game@ (ssh game@host ttt | join message), registered key,
no PTY.
- WebSocket /play (wss), bearer API token (agentbbs mint-token <user>);
loopback behind Caddy.
Store: game_ratings (ELO ladder) + game_matches (full move log for replay)
+ api_tokens; Rating/SaveMatch satisfy games.Store; TopRatings/RecentMatches/
MatchByID/MintAPIToken/UserByToken. Banned accounts blocked.
Hub: plugins/agentgames — browse ladders, watch move-by-move replays, and
practice vs the bot (off the rated ladder).
Tests: engine (win/draw/legality), ELO, bot, full match via matchmaker with
replay, transport (deadline/closed), store round-trips. Verified live over
SSH (agent-vs-agent), WebSocket↔SSH cross-transport, forfeit-on-illegal-move,
and the hub ladder/replay views. Docs in docs/agentgames.md (the canonical
protocol spec, to mirror to logicsrc.com); README M3 → done.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
handleJoin reads the email and verification code interactively, but the
router deliberately skipped the active-PTY guard for join@ on the wrong
assumption that it "prints and disconnects." A client without a controlling
tty (ssh delegating prompts to ssh-askpass) gets no PTY, so the email prompt
blocked forever after the account banner.
Guard handleJoin for a PTY and emit a "reconnect with ssh -t" hint instead of
hanging; fix the misleading router comment.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Add .github/workflows/test.yml via sh1pt node-pnpm-test@1.1.0
* Convert test workflow to Go (go test ./...)
agentbbs is a Go project (go.mod, go 1.26); the Node/pnpm workflow could
never pass here — pnpm/action-setup found no packageManager. Replace with
go test ./... and trigger on main (was master-only). Build/vet live in ci.yml.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: sh1pt-actions-fleet[bot] <287014002+sh1pt-actions-fleet[bot]@users.noreply.github.com>
Co-authored-by: Anthony Ettinger <anthony@profullstack.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Add .github/workflows/ci.yml via sh1pt node-pnpm-ci@1.1.0
* Convert CI workflow to Go (build + vet)
agentbbs is a Go project (go.mod, go 1.26); the Node/pnpm workflow could
never pass here — pnpm/action-setup found no packageManager. Replace with
go build + go vet. Companion test.yml runs go test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: sh1pt-actions-fleet[bot] <287014002+sh1pt-actions-fleet[bot]@users.noreply.github.com>
Co-authored-by: Anthony Ettinger <anthony@profullstack.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
A privileged operator console reached as `ssh admin@host`, gated by route
plus the $AGENTBBS_ADMINS allowlist (admin status is operator-granted only,
never self-assigned in-band). It is a self-contained Bubble Tea model, not a
hub plugin, so it never appears in the public menu.
Sections (PRD §6):
- Users & members: list accounts; b = suspend/ban (operators protected).
Banned accounts are blocked at the hub and pod@ routes.
- Sessions & pods: live in-memory session registry; k = disconnect.
- Moderation & audit: admin action log + agent@ transcripts (tab to switch).
- Config & plugins: runtime snapshot; space = enable/disable a plugin
(persisted; filtered from the hub on next sign-in).
Every privileged action is written to a new admin_actions audit table.
store: + banned column, admin_actions and plugin_state tables, and the
backing methods (ListUsers/SetBanned/RecentSessions/LogAdminAction/
RecentAdminActions/RecentChatsAll/DisabledPlugins/SetPluginDisabled), with
unit tests. auth: admin allowlist helpers + tests. Docs in docs/admin.md;
README M2 flipped to done.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
enable --now leaves an already-running service untouched, so a redeploy's new
binary never loaded. Use enable + restart.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
