Commit graph

76 commits

Author SHA1 Message Date
phucnguyen1707
59013cf0af
Sanitize rendered web content (#77) 2026-06-15 01:34:44 -07:00
phucnguyen1707
cb192906bd
Handle malformed CommandBoard paths (#76) 2026-06-15 01:25:09 -07:00
phucnguyen1707
ae371b91d0
Handle non-finite policy risk scores (#75) 2026-06-15 01:23:47 -07:00
8a86d14ffd
Merge pull request #74 from profullstack/fix/agentmail-lockfile
Fix CI: add plugin-agentmail to package-lock.json
2026-06-14 10:00:41 -07:00
61ed94b000 Add @logicsrc/plugin-agentmail to package-lock.json
The agentmail workspace was added to package.json but the lockfile was not
regenerated, so CI's `npm ci` failed (EUSAGE: missing from lock file). Regenerate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 17:00:21 +00:00
cb05a64438
Merge pull request #73 from profullstack/feat/agentmail-plugin
Add AgentMail plugin (paid-member mailbox client for humans + agents)
2026-06-14 09:56:49 -07:00
e304eac761 Add AgentMail plugin: paid-member mailbox client for humans + agents
@logicsrc/plugin-agentmail provides read/search/compose/send/flag/delete
over an injected MailTransport, gated to Founding Lifetime (paid) members.
Returns plain JSON-serializable domain objects so the same API serves a
human TUI, the CLI, MCP, and bots.

- domain.ts: transport-agnostic types + pure helpers (parse/format address,
  normalizeDraft, isValidEmail, snippet)
- ports.ts: MailTransport seam
- service.ts: AgentMailService (inbox/list/read/search/send/reply/flag/delete)
- access.ts: paid-member gate (assertPaid) + capability constants
- transports/memory.ts: complete in-memory backend (tests/dev/reference)
- transports/mailu.ts: self-hosted Mailu seam (mail.profullstack.com IMAP +
  smtp.profullstack.com submission) with injected IMAP/SMTP drivers
- index.ts: PluginDefinition (manifest, routes, capabilities, tuiPanels)
- registered in the root build; 20 vitest tests pass

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 15:37:17 +00:00
bf046ae280 Add AgentGit M1: agent-native git layer over a Forgejo backend
AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:

- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
  fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
  floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
  policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
  @logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)

27 vitest tests pass; full monorepo build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-14 15:15:06 +00:00
phucnguyen1707
14fe9d608f
Require CoinPay userinfo identity (#21) 2026-06-13 23:01:15 -07:00
RissRIce
63ccad6d2a
fix: handle invalid static path encoding (#36)
Co-authored-by: RissRIce <rissrice2105-agent@users.noreply.github.com>
2026-06-13 23:00:59 -07:00
Autowebassat-blip
3ceddaa911
Parse JSON extension case-insensitively (#29)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:59:39 -07:00
Autowebassat-blip
d9cf41e5a3
Handle malformed static paths (#31)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:59:10 -07:00
Autowebassat-blip
774d461db6
Block IPv4-compatible IPv6 feed URLs (#32)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:58:57 -07:00
Autowebassat-blip
307095d5e9
Fallback invalid CommandBoard web ports (#37)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:58:10 -07:00
Autowebassat-blip
ad3926a006
Handle empty arcade game lists (#38)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:57:56 -07:00
Autowebassat-blip
3afda8c147
Fallback invalid CommandBoard API ports (#39)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:57:43 -07:00
Autowebassat-blip
e89c10cc80
Reject malformed CoinPay webhook signatures (#41)
* Reject malformed CoinPay webhook signatures

* Fix webhook signature type guard

---------

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:56:12 -07:00
Autowebassat-blip
055cc09d14
Fallback invalid CoinPay checkout amounts (#42)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:55:53 -07:00
Autowebassat-blip
ffefd364ce
Ignore malformed feed probe candidates (#43)
Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
2026-06-13 22:55:39 -07:00
lazyGPT07
fbf4d76372
fix(cli): validate positive numeric options (#49) 2026-06-13 22:55:18 -07:00
RissRIce
aa3fdba277
Detect podcast RSS item enclosures (#50) 2026-06-13 22:55:06 -07:00
lazyGPT07
be530ab687
fix(feeds): enforce freshness window (#52) 2026-06-13 22:54:53 -07:00
6D0N9
90fffb124e
fix(agentstack): assignTask refuses tasks in a terminal status (#47) 2026-06-13 22:54:08 -07:00
lazyGPT07
a4cc229120
fix(cli): block config prototype pollution (#54) 2026-06-13 22:52:20 -07:00
FuturMix
f8040e9736
fix(auth): remove hardcoded fallback session secret (fixes #59) (#60) 2026-06-13 22:51:24 -07:00
FuturMix
9d2c485071
fix(commandboard): add body size limit and handle JSON parse errors (fixes #61) (#62) 2026-06-13 22:51:09 -07:00
FuturMix
5cfece3b84
fix(auth): use base64url encoding in session signature verification (fixes #64) (#67) 2026-06-13 22:44:53 -07:00
FuturMix
df040f4ff0
fix(proxy): validate host against allowlist to prevent open redirect (fixes #65) (#68) 2026-06-13 22:44:26 -07:00
FuturMix
13e921c7af
fix(supabase): enable RLS on communication account tables (fixes #69) (#70) 2026-06-13 22:44:13 -07:00
lazyGPT07
7d6a033b41
Enforce trusted-agent policy conditions (#72) 2026-06-13 22:44:00 -07:00
phucnguyen1707
8f4691584c
Handle bad feed path encoding (#9) 2026-06-11 21:07:24 -07:00
6D0N9
3d4345b665
fix(validators): isSchemaKind no longer accepts inherited prototype keys (#14)
'value in schemas' walks the prototype chain, so inherited keys like
"toString" passed assertSchemaKind and then crashed ajv.compile with a
misleading 'schema must be object or boolean' error (e.g. via the CLI).
Use Object.hasOwn for an own-property check.

Adds unit tests rejecting prototype keys and asserting every real
schema kind still passes.

Fixes #13
2026-06-11 21:06:18 -07:00
Autowebassat-blip
73e2464b30
Block IPv6 unspecified feed URLs (#15) 2026-06-11 21:06:03 -07:00
Autowebassat-blip
9942ef8dc6
Ignore invalid feed discovery limits (#16) 2026-06-11 21:04:55 -07:00
Autowebassat-blip
9ed98ceaf7
Accept spaced CoinPay signature parts (#17) 2026-06-11 21:04:41 -07:00
Autowebassat-blip
d558554da3
Reject extra session token segments (#18) 2026-06-11 21:04:25 -07:00
Autowebassat-blip
aa7eb32c36
Return 400 for invalid task JSON (#19) 2026-06-11 21:04:10 -07:00
Autowebassat-blip
301b4ed535
Return 400 for invalid publish JSON (#20) 2026-06-11 21:03:19 -07:00
7cda686059
Add AgentAd ad schemas as a LogicSRC primitive (#10)
* Add AgentAd ad schemas as a LogicSRC primitive

AgentAd is a disclosed, agent-readable advertising contract for CLI tools
and AI agents. LogicSRC owns the canonical schemas; cl1s.tech is the
reference network built on them.

- packages/schemas: agentad-{ad,placement,ad-request,ad-response,
  impression,click,campaign} schemas (id under schemas.logicsrc.com) +
  ad/placement fixtures, exported from @logicsrc/schemas
- packages/validators: register the 7 agentad kinds, wire fixture
  validation, add tests (disclosure.sponsored must be true)
- docs/agentad.md: the AgentAd spec
- README: list AgentAd under v1 priorities

Validators build clean; all fixtures validate; vitest 4/4 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Prepare @logicsrc/schemas for npm publish

Add license, repository, homepage, keywords, publishConfig (public),
and a package README covering both the logicsrc-* core schemas and the
agentad-* family.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-11 21:02:43 -07:00
phucnguyen1707
ad9f3a2a29
Handle invalid JSON request bodies (#7) 2026-06-11 21:00:38 -07:00
850cf5ea44
feat(agentstack): add @logicsrc/agentstack coordination module (#5)
* feat(agentstack): add @logicsrc/agentstack coordination module

AgentStack is the LogicSRC module for portable agent, task, payment, and
reputation coordination across Profullstack apps. Reference implementation of
the `agentstack` capability in the Profullstack Shared AppKit OpenSpec.

- packages/agentstack: DID helpers (did:coinpay:user/agent), DidTask model +
  lifecycle, AgentStack in-memory coordinator (agents, tasks, delegation,
  events), and a validated LogicSRC plugin definition. 9 vitest cases.
- Wire @logicsrc/agentstack into the root build chain (after plugin-core).
- docs/agentstack.md + mention in openspec-comparison.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(agentstack): note dual-runtime support (Bun + Node.js + Workers + browser)

Matches the revised Shared AppKit PRD's Runtime Compatibility Strategy.
AgentStack is runtime-neutral (no Bun/Node-only APIs; time is injected).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-10 16:39:32 -07:00
c23ce42948 Add communication account plugin scaffolds 2026-06-09 10:02:07 +00:00
5cfeea6b57 Add feed discovery plugin 2026-06-09 09:34:31 +00:00
e47616bf9d fix(web): CI E2E — resilient blog/RSS without Supabase + update stale test
The dynamic /blog/rss.xml returned 500 in CI (no Supabase env) and the E2E
still asserted the old static feed's hand-written items.

- /blog, /blog/[slug], and /blog/rss.xml now degrade gracefully (empty feed/
  list, HTTP 200) when Supabase is unavailable, instead of throwing.
- E2E: assert the always-present channel <title>LogicSRC Blog</title> and a
  looser xml content-type, dropping the removed static post titles.

Verified with `next dev` and no Supabase env (CI conditions): rss/blog/sitemap
all return 200.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 13:00:51 +00:00
74abf8985f feat(web): og:image, /pricing + FAQ schema, llms-full.txt, GitHub nav
More AEO audit fixes (the content-independent quick wins):

- Generated 1200x630 OpenGraph/Twitter card (app/opengraph-image.tsx);
  drop the SVG fallback and use summary_large_image.
- /pricing page with question-style headings and FAQPage JSON-LD; clarifies
  the spec/tooling is free and implementation is $250/week.
- /llms-full.txt — full markdown of the curated docs concatenated for
  large-context RAG ingestion.
- GitHub link added to both navs (SPA rail + SiteShell) and Pricing nav item;
  /pricing added to the sitemap.

Verified in a running build: og image renders as PNG and is referenced in
head; /pricing serves FAQ + schema; /llms-full.txt concatenates docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:51:51 +00:00
fb20fd2e99 feat(web): real /about and /docs pages (unique crawlable content)
Addresses the top cross-engine AEO finding — every route previously served
the homepage SPA. /about and /docs are now distinct routes with their own
server-rendered content and titles.

- /about: substantive about page (what LogicSRC is, the standards surface,
  CommandBoard.run reference impl, GitHub, hire-us) — derived from public
  positioning, no fabricated team.
- /docs + /docs/[slug]: render the repo's docs/*.md (curated public set) via
  marked, statically generated at build (no runtime fs dependency).
- Drop about/docs from the catch-all; add doc URLs to the sitemap.

Verified in a running build: /about and /docs serve unique content with
distinct titles; /docs/[slug] renders each markdown doc.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:43:42 +00:00
6518dfb4a9 feat(web): AEO foundation — robots, JSON-LD, meta, llms.txt, security headers
Implements the high-signal, content-independent fixes flagged across the
multi-engine AEO audit:

- robots.txt (app/robots.ts): allow mainstream + AI crawlers (GPTBot,
  ClaudeBot, PerplexityBot, Google-Extended, …), disallow /api, link sitemap.
- Organization + WebSite JSON-LD on the root layout; BlogPosting JSON-LD on
  /blog/[slug].
- Richer metadata: descriptive default title, Open Graph + Twitter cards,
  canonical, icons, metadataBase.
- Per-route titles/descriptions for catch-all routes (docs, about, hire-us,
  agent-swarm, …) instead of the generic "LogicSRC".
- /llms.txt (llmstxt.org) and /skill.md capability manifest.
- /.well-known/security.txt (RFC 9116).
- Security headers via next.config: HSTS, X-Content-Type-Options,
  X-Frame-Options, Referrer-Policy, Permissions-Policy (CSP intentionally
  deferred to avoid breaking inline/stats/CoinPay scripts).

Verified in a running build: all routes serve correctly and headers are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:38:27 +00:00
ce79f02211 fix(web): correct blog colors for the light workspace + thumbnails
Only the .rail sidebar is dark; the .workspace content area is on the
light (#f6f7f4) page background. The previous blog styling assumed a dark
workspace, so text was light-grey on white (unreadable) and the link
green was too light.

- Darken the global link color to #0a7d59 (readable on white); content
  links only — rail nav stays inherited.
- Repaint .blog-content (post HTML) for a light surface: dark body text,
  light code/pre, light borders.
- Blog index/post: dark titles, readable grey meta, light row borders;
  light-themed footer.
- Add post thumbnails to the /blog index from featured_image.url.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:21:46 +00:00
7e11130467 feat(web): site chrome on /blog + distinct content link color
- Add SiteShell (rail nav + workspace + footer) and wrap /blog and
  /blog/[slug] in it so they share the site's dark chrome instead of
  rendering as bare standalone pages.
- Style rendered post HTML (.blog-content) for the dark workspace.
- Links were `color: inherit` everywhere, so content-area links matched
  body text and were invisible. Give links a distinct accent (#5ac8a6);
  keep the rail nav and buttons on their own colors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 12:12:54 +00:00
cf99e93c53 feat(web): blog-post ingestion webhook + /blog, dynamic RSS & sitemap
Add an autoblog webhook receiver and a Supabase-backed blog to logicsrc-web
(the app had no Supabase usage before).

- Migration: blog_posts table (RLS: public reads published, service-role
  writes). Applied to the linked project.
- POST /api/webhooks/blog: verifies the Standard Webhooks signature against
  BLOG_WEBHOOK_SECRET via @profullstack/autoblog verifyAndParse (no admin
  user — shared secret only) and upserts the post by slug.
- /blog index + /blog/[slug] render published posts from the table.
- /blog/rss.xml and /sitemap.xml are now dynamic, generated from the table;
  removed the static public/sitemap.xml and public/blog/rss.xml.
- BLOG_WEBHOOK_SECRET added to .env.example.

Verified end-to-end: a signed sample post delivered 200 and appeared in the
index, post page, RSS, and sitemap; build + typecheck pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 11:53:43 +00:00